What an audit is (and isn't)
An audit is a structured manual and tool-assisted review of a contract's logic against its intended behavior, looking for ways an attacker could break invariants, drain funds or lock the contract. It is not a guarantee of safety — audits find bugs the reviewers thought to look for, not all bugs, which is why high-value protocols combine audits with bug bounties, formal verification and staged rollouts.
- •Audits review a specific commit; any later change is technically unaudited.
- •Multiple independent audits reduce but never eliminate risk.
- •'Audited' is a process claim, not a safety certificate.
Reentrancy and state ordering
Reentrancy happens when an external call in a function hands control to another contract before the caller's own state has been updated, letting that contract call back in and act on stale state — the classic exploit pattern behind The DAO hack. The standard defense is checks-effects-interactions: validate conditions, update state, and only then make external calls, often reinforced with a reentrancy guard modifier.
- •Update balances before sending funds, never after.
- •Treat every external call, including token transfers, as a potential reentry point.
- •A reentrancy guard is a safety net, not a substitute for correct ordering.
Access control and trust assumptions
Auditors ask, for every state-changing function: who can call this, and what happens if they are malicious? Missing onlyOwner-style checks, unprotected initializer functions on upgradeable contracts, and overly broad admin powers (mint, pause, upgrade) are recurring findings. Every privileged role should be justified, minimized and ideally behind a timelock or multisig rather than a single EOA.
Arithmetic, oracles and external dependencies
Since Solidity 0.8 arithmetic reverts on overflow/underflow by default, but auditors still check for rounding errors, division-before-multiplication precision loss, and unchecked blocks that opt back into raw wraparound. Price oracles are a separate high-risk category: a contract that reads price from a single thinly-traded on-chain pool can be manipulated in a single transaction via a flash loan, which is why audits flag any pricing logic that isn't using a time-weighted or multi-source feed.
- •Prefer battle-tested libraries over reimplementing math.
- •Flash-loan-manipulable spot prices are a top recurring finding.
- •Unchecked blocks need an explicit, documented justification.
A working process, not just a checklist
A real audit layers automated tools (static analyzers, fuzzers) with manual review of business logic and, for critical protocols, formal verification of key invariants. Findings are usually graded by severity (critical/high/medium/low/informational) and the project remediates and gets a follow-up review before the report is finalized — the report date matters as much as its content.