Awesome Audit Methodologies

A curated list of "just read the code bro" resources.

0x52:

• His Auditing Strategy (Discord thread)
• Audit Notes (GitHub repo)

Alix40:

• Auditing math heavy functions (X post)

cergyk:

• BUG HUNTING TATICS WITH CERGYK.ETH (video)

Charles Wang:

• Taking a break during the audit (X post)

CMichel:

• How to become a smart contract auditor (blog article)
• How could I have found that faster? (X post)
• How to read reports (X post)
• Thinking about how an implementation should look like (X post)

curiousapple:

• 2 ways to review DeFi smart contracts (X post)

Dacian:

• How do you understand a codebase then how do you go from understanding to finding bugs? (X post)

Daniel Von Fange:

• How to find all the bugs in code review (video)

Dravee:

• Mindsets of Auditing (video)

HollaDieWaldfee:

• Audit methodologies are overrated (X thread)
• Audit Notes (GitHub repo)

infosec_us_team:

• Don't dive into a random line of code and hope for the best (X post)

Juan:

• How I find vulnerabilities in smart contracts (X article)

Kirk Baird:

• A Security Engineer's Guide to Reviewing Core Blockchain Nodes (blog article)

MiloTruck:

• MiloTruck Interview - 2 Hours of PURE Smart Contract Auditing ALPHA (video)
• Web3 Security Contests With Milotruck (video)
• Old Smart Contract Audit Methodology (Readme)
• His auditing approach (Discord thread)

Mudit Gupta:

• Auditing Smart Contracts - Security Review of Ethereum Applications (video)
• Smart Contracts Risk Analysis and Flash Loan Exploits - Ethereum Security (video)

nisedo:

• How to look where test coverage is lacking (X post)
• First, list every entry point a user can interact with (X post)

OwenThurm:

• The Auditing Process (blog article)
• Everything you need to know about the audit process, combined into a single handbook (X thread)
• Complete Smart Contract Auditing System (video)
• How To Find SO Many Criticals You Get Bored Of Auditing (video)
• Live Audit Series (videos)
• Audit With Me | Live Codehawks Contest (video)
• [LIVE] How To Find Vulnerabilities In Audit Contests - GTDA | C4 Contest (video)

Phil:

• Auditing Step By Step: Part 1 (X thread)
• Finding Ways To Break Smart Contracts (Auditing: Part 2) (X thread)

samczsun:

• DeFi Lecture 12: Practical Smart Contract Security (video)

Riptide:

• Read through a codebase and write down the... (X post)

Tincho:

• Question until it crashes (blog article)
• Top Web3 Security Researcher Gives you his EXACT Audit Process | Damn Vulnerable DeFi creator Tincho (video)

Tigran Piliposyan:

• Intense concentration is key (X post)

Trust:

• trust_90: NSO Group Hacker turned Web3 Security Researcher (video)
• When you open a smart contract in your favorite editor, what do you see? (X thread)
• Reporting tips (X post)

WhiteHatMage:

• don't look for bugs, look for vulnerabilities (X post)
• searcher & researcher (X post)

Zach Obront:

• Audit Process (X thread)
• Zach Obront: Winning Audit Contests & Crushing Bug Bounties (video)
• Anytime I don't catch an issue (X post)

Zigtur:

• The Journey to Earning $500,000+ as a Security Researcher | Cantina (video)

---

Other:

• Art Of Auditing (blog articles)
• The Art of Software Security Assessment: Identifying and Preventing Software Vulnerabilities, Part I (book)