deadrosesxyz@deadrosesxyz
Everything I've learned about auditing in 2023
- Do what everyone does, get what everyone gets.
I seriously can't emphasize this enough. If you're reading and learning from the same sources as everyone else, you basically can't beat the rest. If you want to be an outstanding auditooor, you have to go off the beaten track and dive deep into the unknown.
- Stop learning unnecessary stuff.
Seriously. You don't need to learn hardhat just in case. You don't need to know assembly just in case. Could you ever end up in a situation where it would've been better if you knew them? Well, yes. However, these things 100% don't offer the highest Expected Value. Focus on what's most important and always aim for the stuff which offers the highest Expected Value
- We all suck.
Sorry to break it to you, but we all suck. Tier 1 firms miss highs and criticals on a daily basis. And then we just cope and say "One audit can never be enough, there should be at least 5 different audits, 7-figure bug bounty bla-bla". One audit SHOULD be enough. We just aren't good enough yet. I've seen many people argue that the Kyber vulnerability was "Impossible" to be caught during an audit due to its complexity. If you seriously believe so, you ngmi
- Private/ Solo audits isn't this magical utopia everyone should be aiming for.
I don't know why everyone believes private audits should be their end-goal. It contains way too much dull work. (such as writing reports or checking the same functions for the 100th time as you need to be 100% sure in the service you provide) There's great value to be extracted from contests, bounties and working in a firm as well.
- Know your worth.
Since September I've received exactly 10 requests for audit. How many did I accept? Just 2. The reason why 8 times we couldn't reach a deal? There was someone who offered a lower price. In such cases just accept it and move on. No need to start undercutting the market. Let your results speak for themselves.
- Do not rush audits.
My favorite thing is when a project contacts me and needs an audit FAST. 4,000 sLOC and they need it audited in a week. You should never even consider accepting any offer of this kind. Best thing you can do is explain to them why this is straight up impossible and setting up for failure.
- Know your strengths.
I know I can get a good understanding of a codebases relatively quick. How do I utilize it? I hunt projects launched on Immunefi immediately as they launch. My fastest bounty was a Critical submitted 1h 15min after the protocol launched their bbp. I managed to submit it before the protocol even had publicly announced they've launched a bbp.
Final thoughts:
Web3 security is currently in its infancy. We all suck. This should never be an excuse to not improve ourselves. If you want to be an outstanding SR, you should never be okay with missing bugs. Keep improving yourself every single day. That being said, if you simply manage to suck less than the rest, you'll literally be able to print money.
and last but not least...
DM FOR AUDITS
