Ask Me Anything 0x52

Summary

This transcript shares insights from an experienced smart contract auditor, detailing their approach to auditing, productivity strategies, and learning methods. The speaker emphasizes setting personal goals, maintaining focus through structured routines, and enjoying the auditing process to avoid burnout. They discuss the importance of hands-on experience, tracking progress, and reviewing others' submissions to improve skills. With a background in video games, the speaker highlights the connection between complex system understanding and successful auditing. The transcript also covers efficient management of large codebases and the balance between participating in contests and private audits.

Takeaways

• 😀 Set clear goals to stay motivated: The auditor aimed to audit at least 100 codebases before considering giving up, which helped maintain focus even during tough times.
• 😀 Work-life balance is important: They limit themselves to 6 hours per day of auditing to avoid burnout and maintain high productivity.
• 😀 Consistency is key: They averaged 21 days of auditing per month, with November being their most productive month (29 days).
• 😀 Strategic approach to audits: Their process includes reviewing the README, examining files in VS Code, and systematically identifying vulnerabilities with detailed notes.
• 😀 Learning through hands-on experience: The auditor learned coding and auditing primarily through contests and personal testing, emphasizing a 'learning by doing' approach.
• 😀 Burnout management: Taking breaks and not forcing work when uninterested are crucial strategies to prevent burnout and maintain long-term productivity.
• 😀 Video game experience helped in auditing: Their background in optimizing characters in video games (min-maxing) translated well to auditing, as both require deep understanding of systems and mechanics.
• 😀 Focus on quality over quantity: When working on contests, the auditor strives to give at least 70% effort for regular contests and 85% for leadership roles, focusing on completing each contest before starting the next.
• 😀 Mental model for threat modeling: They build a mental map of the codebase and focus on identifying weak points, such as critical parameters without safeguards.
• 😀 Learn from others' submissions: Reviewing others' findings on the same codebase is a valuable way to identify missed vulnerabilities and deepen understanding of the code.
• 😀 Set personal benchmarks and track progress: The auditor tracks key metrics such as time spent, severity of issues, and estimated payouts to gauge their performance and improvement over time.

Q & A

How did you manage to audit 115 codebases in one year?

The auditor set a clear goal to audit at least 100 codebases before considering giving up, which provided motivation. They also worked consistently, spending an average of 21 days per month auditing, and avoided burnout by limiting daily auditing hours to 6 or fewer.

How did you ensure productivity during such a high volume of audits?

The auditor avoided long working hours, limiting themselves to a maximum of 6 hours per day to maintain focus and avoid diminishing returns. They also allowed for breaks, which helped them stay refreshed and productive throughout the year.

Can you describe the typical auditing process you follow?

The process involves thoroughly reviewing the README file, opening all files in VS Code, understanding the code’s purpose, rearranging files for clarity when necessary, reviewing contracts in-depth, marking issues, and then compiling a comprehensive report. It’s a fluid process with flexibility depending on the project.

What factors contributed most to your growth as an auditor?

Key factors included working on lead projects (such as 'Lead Watson for Sherlock'), reviewing other auditors' submissions, and consistently challenging oneself to identify vulnerabilities in the code. The thrill of finding bugs and the continuous learning process also contributed significantly.

What advice do you have for someone starting their auditing career?

Start with a hands-on approach, as practical experience is essential. Push yourself out of your comfort zone early, and enjoy the learning process. Also, reviewing other auditors’ submissions after completing your own can deepen your understanding of the code.

How do you deal with burnout during your auditing work?

The auditor rarely experiences burnout due to their passion for auditing. When burnout does occur, they take breaks (like the two-week break they mentioned) and come back feeling refreshed. They also avoid forcing themselves to audit when not in the right mindset.

How did you learn the necessary coding skills for auditing, especially in the beginning?

The auditor learned primarily by participating in contests and testing code in Remix. They also developed a mindset for 'bending the rules' naturally, which helped in understanding and auditing code, even though they initially struggled with understanding the code itself.

What is your approach to threat modeling and protocol auditing?

The auditor builds a mental model of the codebase and identifies weak points, particularly looking for key parameters without safeguards. They then check for various input scenarios, including edge cases, to ensure the code is robust and secure.

How do you handle large codebases during an audit?

To manage large codebases, the auditor splits the code into multiple functional areas and organizes them across several VS Code windows. This keeps everything accessible and manageable during the audit process.

What is your method for tracking progress during audits?

The auditor tracks various metrics such as audit time, number and severity of issues identified, personal performance, and the payouts of contests or private audits. Tracking these stats provides motivation and helps in assessing overall progress, though it is not the deciding factor for their work.