What your auditor REALLY thinks but is afraid to tell you...
summary
Auditors report that projects still launch immediately after receiving a stamp of approval, despite time‑boxed reviews and finite budgets; one firm maintains Lighthouse which runs ~33% of Ethereum, and teams repeatedly ship contracts with no unit or integration tests (a lending codebase failed simple deposit/withdraw locally). Recommendations: aim for 100% test coverage, run mainnet simulations and invariant testing, document supported token assumptions, track dependencies for supply‑chain risk, and expect auditors to write test examples but not to fix or own production deployments.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 1:44Security responsibility
- 10:49Project not audit-ready
- 17:54Audit as formality
- 23:56Overrated vs basics
- 33:31Client requests outside scope
- 37:25Q&A on NDAs and liability
- 43:43Closing remarks and future initiatives
related talks
30mSmart-Contract Security 201: Auditing Lessons for Solana Founders
01h 02mDiscussion - Auditors, Sessions 3 & 4
15mWhy Smart Contract Audit is Not Enough
31mNeed of Web 3.0 Security
52mEscaping Developer Nightmares
17mDiscussion - Protocols, Session 2
15mSearching Outside the Streetlight
04mWhat Should the Scope of the Web3 Audit Look Like?