Auditing Smart Contracts

Authors:         Wayne Landsman, Evgeny Lyandres, Edward Maydew, Daniel Rabetti, Che Zhang

Discussant:   Andreas Park
 

Overview of Discussion

So what is Blockchain & DeFi about?

What our financial infrastructure looks like

What would the most efficient financial infrastructure look like?

But there is more: TradFi = Intermediated

• everything is driven by intermediaries
  • access to infrastructure
  • holding and operation of assets

DeFi = self-determined & open

1. Self-custody and selfcontrol of assets
2. Unfiltered access to financial infrastructure
3. Free entry of service providers
4. Conceptually non-custodial services run as autonomous codes on the infrastructure
5. Blockchain = common resource
6. Services = platforms

Blockchain-based Decentralized Finance in a Nutshell

1. Self-custody and selfcontrol of assets
2. Unfiltered access to financial infrastructure
3. Free entry of service providers
4. Conceptually non-custodial services run as autonomous codes on the infrastructure
5. Blockchain = common resource
6. Services = platforms

What the focus of this paper?

What's special about smart contracts?

What is a smart contract/DeFi application?

• piece of code that performs operations on the blockchain
• can be
  • called (= used) by anyone
  • deployed by anyone
• organized
  • as a platform
  • often requires deposits of assets
  • often involves transfers of assets
• immutable?
  • actually not exactly...

some features

A word about tokens: What might token investors be concerned about?

• Prat, Danos, Marcasse (Management Science 2025) "Fundamental Pricing of Utility Tokens"
  • tokens first sold to investors ...
  • ... but eventually make their way to users
• hidden features of tokens:
  • Squid Game Token could not be sold
• Do the economics of the tokens work?
  • set incentives
  • pay for usage
  • optimizing for usage and income
  • payment mechanisms
• trust issuer?
  • can the be interference?
  • will there be updates and continuoed development (Canidio 2022)

• tokens are mostly financial instruments
• ... but they don't neatly fit into our existing nomenclature
• same for issuers, usage, evolution of tokens
• requires a different "mindset" to understand 

Three Examples of Exploits

What can we do to prevent exploit? What are common fault lines? 

• do transfers work under all circumstances
  • edge cases matter
• reliance on oracles
  • use price and input from other sources
  • oracles can be manipulated
• applications may be used by others in unexpected ways
  • flash-loan attacks
  • unobserved risks created by users (Morpho)
• smart contract code of other applications that you rely on may change
  • Morpho v. AAVE

What is so special about "auditing" smart contracts?

• software code reviews and standards are nothing new
• cyber-attacks happen everywhere
• ... yet blockchain is different
• Cyber-attack: indirect cost
  • loss of data
  • loss of secrets
  • abuse of information
• Blockchain exploit:
  • direct loss of funds of customers/users
  • often irretrievable
  • no accountability, no recourse
  • no ability of courts or regulators to order return of funds

The cyber-attack \(-\) code-review  problem

known
knowns

unknown
knowns

known
unknowns

unknown
unknowns

• write the code as well as you can before you deploy
• code audit verifies that you
  • followed the right procedure
  • made no obvious error

• you lacked full expertise and missed important checks
• code audit identifies the issue and allows you to fix them

• you get caught off-guard by problems that you didn't think would be a problem
• you need out-of-the-box thinking

This Paper: The Code Review Decision

July 31, 2025: "today I am announcing the launch of “Project Crypto”—a Commission-wide initiative to modernize the securities rules and regulations to enable America’s financial markets to move on-chain."

Overall View

• code reviews/audits will become a major topic in the policy debate and will grow in importance over the next decade as finance moves on-chain
• many important questions and we haven't scratched the surface
  • standards, processes, what level of resilience, accountability, by whom to whom, legality

1. Code Review Decision

   • Who asks for code review?
   • What type of review?
     • Centralized firm? What level of reputation?
     • Decentralized “bounty” system?

2. Audit Effectiveness

   • Do audits reduce the likelihood or severity of future security breaches?

3. Post-Breach Responses

   • How do developers and auditors react after hacks?
   • Effects on auditor reputation and market share?

Research Questions

When do you do the review? Circumstances may matter

What kind of code review?

1. Audit Demand

• Who seeks audits?
  • oracles, bridges, cross-chain designs, lending logic.
• Top tier
  • Larger and more visible protocols.
• Ex exploit
  • Systemic hacks increase demand for high-reputation audits.

Main Findings Part 1: Audit Demand

Main Findings - some niggles

• many co-variates have a hindsight feel and create look-ahead bias
  • "vulnerability" is  ex-post proven
    • "novel" vs anticipated exploit?
    • \(\to\) after Balancer, we could now add AMMs to the list
    • Can you find contemporaneous measures like documentation flags, omissions in prior year? 
  • "larger" =TVL is ex post & hard to separate from audit 
    • use revenue projections, testnet activity, intended fundraising $$
• Log_raised and listed are likely correlated
  • Binance listings are very expensive (>$1M in early 2020s)
  • \(\to\) need to be well-funded
• Github commits
  • See Daniel's other work on code-washing

• Naive average:
  • audits do not reduce hack probability.
• Correcting for selection
  • top-tier and decentralized (bounty) audits are associated with fewer and smaller losses.

Main Findings: Audit Effectiveness

decentralized "bounty" program

code audit firm

high repuation (and pricey)

unknown (but cheap)

More niggles: Audit Effectiveness

• Hacked protocols:
  • upgrade auditors or
  • add bounty programs.
• Auditors implicated in hacks
  • lose about 4 pp of market share short-term, but usually recover.
  • Strong, visible crisis management mitigates reputational damage.

Main Findings: Post Breach Effects

Niggles on Post Breach Effects

• narrow definition which may miss sector-specific risks
  • lending: Cream Finance, bZx, Mango
  • stablecoins: Terra-Luna
  • Governance/DAO: Beanstalk
• high alignment of treatment with oracle/cross-chain risk group \(\to\) overstate generalizability?
• could lead to under-identification, or capture some spurious correlation

Last words: it's still early ...

The view of blockchain, Crypto, and DeFi according to "some"

History of Crypto and Blockchain how I'd like you to see it

Timeline of DeFi Development vs. Rest of World's Understanding

2008/9

single-purpose blockchain

The Bottom Line: Crypto is ...

1. A crazy world of vaporware, gambling, scams, fraud, rug-pulls, money laundering, Bitcoin-crazy nutters, Fartcoin, Hawk-Tuah Tokens
    
2. A serious attempt to make finance better, more efficient and remove frictions, more competitive, cheaper, faster