Draft:Smart contract auditing
Security review process for blockchain smart contracts
From Wikipedia, the free encyclopedia
Smart contract auditing is a security review process that examines smart contract code to identify vulnerabilities, logic errors, and potential exploits before or after deployment on a blockchain network.[1] The practice emerged following several high-profile security incidents in the cryptocurrency ecosystem, most notably The DAO hack in 2016, and has since become a standard component of decentralized finance (DeFi) protocol development.[2]
Submission declined on 31 January 2026 by ScalarFactor (talk).
Where to get help
How to improve a draft
You can also browse Wikipedia:Featured articles and Wikipedia:Good articles to find examples of Wikipedia's best writing on topics similar to your proposed article. Improving your odds of a speedy review To improve your odds of a faster review, tag your draft with relevant WikiProject tags using the button below. This will let reviewers know a new draft has been submitted in their area of interest. For instance, if you wrote about a female astronomer, you would want to add the Biography, Astronomy, and Women scientists tags. Editor resources
|  |
History
The DAO hack and early development
The smart contract auditing industry emerged largely in response to The DAO hack of June 2016, in which approximately $60 million worth of ether was stolen from a decentralized autonomous organization through a reentrancy vulnerability.[3] The incident demonstrated that smart contracts, once deployed, are immutable and that vulnerabilities can have immediate financial consequences.[4]
Market growth
A 2025 academic study analysing 8,195 audit reports from 117 firms covering 1,575 DeFi protocols between 2020 and 2023 documented the rapid growth of the smart contract audit market.[5] The study found that audit decisions correlate with protocol characteristics and that protocol performance is associated with auditor market share.[5]
Methodology
Smart contract audits typically combine manual code review with automated analysis tools.[6] A 2024 study in Electronics presented a comprehensive security audit method integrating static analysis, formal verification, and symbolic execution, achieving 81% precision in detecting vulnerabilities across 148 tested contracts.[6]
Audit phases
According to the OWASP Smart Contract Security Testing Guide, a standard audit process consists of several phases:[1][7]
- Preparation – establishing scope, reviewing documentation, and setting up a reproducible testing environment
- Design review – analysing the system architecture and identifying essential protocol properties (invariants)
- Code review – manual inspection searching for mathematical errors, logic flaws, and coding mistakes
- Automated testing – running static analysis and symbolic execution tools
- Reporting – documenting findings classified by severity and difficulty
- Remediation verification – confirming that identified issues have been properly addressed
Automated tools
Researchers have developed various automated tools to supplement manual review. A 2025 systematic survey in the Journal of Network and Computer Applications evaluated 256 smart contract analysis tools, categorising them by methodology including fuzzing, machine learning, symbolic execution, and formal verification.[8]
Static analysis tools analyse source code without executing it. Slither, introduced in a 2019 IEEE workshop paper, uses an intermediate representation based on static single assignment to detect vulnerability patterns and has been shown to outperform other static analysers in speed and accuracy.[9]
Symbolic execution tools explore possible execution paths to identify potential exploits. Recent research has combined these traditional approaches with large language models; a 2024 arXiv paper introduced LLM-SmartAudit, a framework using multi-agent conversational approaches that reportedly outperforms traditional tools in detecting complex logic vulnerabilities.[10]
Common vulnerabilities
A 2024 systematic literature review in Information and Software Technology catalogued smart contract vulnerability detection techniques and the specific vulnerabilities they target.[11] A comprehensive survey in the Journal of Network and Computer Applications identified common vulnerability categories:[12]
- Reentrancy – vulnerabilities allowing an attacker to repeatedly call a function before previous invocations complete, as exploited in The DAO hack[2]
- Integer overflow and underflow – arithmetic errors that can result in unexpected values
- Access control flaws – improper restrictions on who can execute sensitive functions
- Front-running and MEV – vulnerabilities to maximal extractable value extraction where transaction ordering can be exploited
- Logic errors – flaws in business logic that allow unintended behaviour
A December 2024 systematic review examining 222 high-quality papers identified 192 distinct vulnerability types organised into 13 categories, along with 219 detection tools and 133 benchmarks for evaluation.[13]
Notable security incidents
Several major cryptocurrency thefts have highlighted the importance of smart contract security:
- In February 2022, approximately $323 million was stolen from Wormhole, a cross-chain bridge, due to a vulnerability in signature validation.[14]
- In March 2022, the Ronin Network, which supports the game Axie Infinity, lost approximately $540 million in a hack attributed to North Korea's Lazarus Group.[15][16]
Limitations
Research indicates that audits may have limited effectiveness in preventing security breaches. The 2025 SSRN study found "limited evidence" that audits reduce future security incidents and observed that protocols are more likely to switch auditors after experiencing a breach.[5] A July 2024 systematic review found that classical machine learning techniques outperformed static analysis tools in vulnerability detection, suggesting room for improvement in current auditing approaches.[17]
LLM-generated pages with the below issues may be deleted without notice.
These tools are prone to specific issues that violate our policies:
Instead, only summarize in your own words a range of independent, reliable, published sources that discuss the subject.
See the advice page on large language models for more information.