New as Smart Contract Auditor? Try Codehawks First Flights
Want to be a smart contract auditor? Contact me for learning paths, advice and real-world challenges by email at aitor.zaldua@draftdigital.xyz or in X as @azdraft_.
I have never seen anything like it in my life. Yes, you can win the lottery, marry a millionaire or be a pirate and find a treasure on a remote island.
But this is even better. Because you can make a lot of money with your skills. Just by being a smart contract auditor.
For example, today, there is a pot of $1.565 million across 8 audit competitions ready to be taken by the auditors. All you have to do is enter the competitions in code4rena, sherlock or codehwaks and work on the audit for the specified time. If you find vulnerabilities, you get paid. As simple as that.
But being a smart contract auditor is not easy from the start. Imagine you want to be a doctor, an engineer or a lawyer. You already know the universities, right, but how do I start to become an auditor? Search on youtube? Is this my only chance?
No, it is not. There are a few options with clear learning paths and this week we have a new player in town. Codehawks itself, the competition platform created by cyfrin, offers us a really interesting opportunity to get into the business.
First Flights are taking Off!
They call this option “First Flights” because they are code hawks (clever!) and they have the intention of publishing a competition every week, very similar to real audits, but with a friendly level of knowledge.
Of course, instead of paid audits, you will have the opportunity to earn XP points and have your CV exposed to potential clients. The more XP you have, the more chances you have of being contacted by companies for private audits.
And, of course, you will learn how to become an auditor to compete in real competitions.
First Flight #1: PasswordStore
So if you feel the call, just hear it and be brave! become a smart contract auditor! You can start with this first challenge.
As soon as you clone the Github repo, you feel like you are actually looking at a real smart contract and a real audit. It is developed with Foundry, it has their scripts and tests… The Codehawks team encourage you to publish an audit report as you would for any competition so very well done, mates!
So there is a lot to do here. As there are different levels of knowledge in the learning process, I am going to give you 3 tracks to start with, depending on 3 different levels of knowledge. If you are already above the last level, congratulations, you are really ready for the competitions. If you are in the middle, I hope this will help you on your way.
1.- You are just starting out and this is one of your first contacts.
Start as an auditor is hard for everybody, including the current rock stars in the industry, so don’t panic.
The smart contract to be audited is located in the src folder and is called PasswordStore.sol.
There is a sort of database of vulnerabilities or known issues, and the way to find bugs in the code is to specifically go through the code and see if you find one of those issues. For example: We know that 1 + 1 = 2. Can you find an operation in the code that says 1 + 1 = 3? That’s your vulnerability.
So try to find the thing that’s not true or doesn’t match the database of vulnerabilities that you have stored in your brain.
2.- You see the mistake, but you don’t know how to prove it.
The developer has made a mistake and you can see it very clearly. But it is not as simple as saying “this is the problem, add/delete/modify this and it is fixed” because the platform requires you to prove it. It is a task known as Proof of Concept (PoC).
In Foundry, you usually do this by running a test in the test folder. The code already has a test and the PoC will be very similar to one of them. You need to create a test that “proves the concept” like “If I put 1 + 1 the protocol will return 3”.
3.- You know the vulnerability, but you don’t know how to prove it.
OK, that’s great because we know the vulnerability, but in this case we need to go a little bit further to prove it by running the local blockchain, deploying the contract and checking the results of our actions.
The local blockchain with Foundry is called Anvil. With it you can do the deployment and you will also have a bunch of addresses to make transactions.
You also need to know how to use cast to query the transactions.
Conclusions
A lot of Foundry indeed! is the perfect framework for developing and testing our code, and you will find a lot on your audit journey. The Foundry book contains all the knowledge you need to solve this challenge, apart from the vulnerability itself of course, so take a look and try to create the perfect PoC.
Hats off to Codehawks for this perfect way to use our skills as junior auditors, I can’t wait for the next competition and growth as a smart contract auditor and security researcher.
