Smart contract audit and security in Corsica
A smart contract audit is a methodical review of a blockchain contract's code. It is there to catch vulnerabilities and logic errors before they turn expensive. From Bastia, we analyse your Solidity contracts and hand you a clear report in which every issue is ranked by severity. Then we check your fixes.
What is a smart contract audit?
A smart contract often manages rights, approvals or assets. Once deployed, its code is not easy to patch. A mistake is therefore visible to everyone and hard to put right, which is why it pays to find it first.
An audit combines two approaches. Automated analysis tools flag dangerous code patterns that are already known. A manual review, line by line, checks that the contract does exactly what it should, and nothing more. What comes out at the end is an audit report, describing each issue found with its severity and the recommended fix.
Smart contract security goes beyond technical flaws. We look just as closely at admin rights and external dependencies, as well as at consistency with your business rules.
When should you commission a smart contract audit?
- 01
Before going live
This is when an audit helps most. Fixes are still simple, and nothing is exposed.
- 02
Before an upgrade
A new version, however minor, can bring a flaw into previously sound code.
- 03
Before relying on a third-party contract
You are integrating a partner's contract and want to know what it really allows.
- 04
When accepting delivered work
You commissioned a contract from a supplier and want an independent view before signing it off.
- 05
After unexpected behaviour
An unexpected transaction has taken place. You want to understand where it came from, so it does not happen again.
Smart contract security, who needs it?
- 01
Startups
Before a launch or a presentation to partners, an audit report shows that security has been taken seriously.
- 02
Businesses and supply chains
On traceability or document timestamping contracts, the audit checks that only authorised participants can write. It also checks that nobody can falsify the records.
- 03
Public bodies
To validate work commissioned from a supplier before it goes into service, and to check it meets the specification.
- 04
Development teams
To get a second pair of eyes on code they know too well to spot its blind spots.
How a smart contract audit unfolds
The audit covers a frozen version of the code. It can be carried out entirely remotely, and we work from Haute-Corse with teams on the island as well as elsewhere.
- 01
Scope
Together we fix the exact version of the code to audit, the contracts included or left out, the documentation available.
- 02
Understand
We read the specifications and talk to the team, to understand precisely what the contract is meant to do.
- 03
Analyse
Automated analysis, manual review, additional tests. We go through the main families of known vulnerabilities, such as access control flaws or logic errors, drawing on public references like the OWASP Smart Contract Top 10.
- 04
Report
We write the report and then present the results, with explanations a non-specialist can follow.
- 05
Verify
Once you have made your fixes, we review the changes. The report is updated with the status of each point.
The audit report and what happens next
The report opens with a summary that management can read without a technical background. It covers the scope and method, the number of issues at each severity level, an overall conclusion. The findings follow one by one, each with its description, the risk in simple terms, where it sits in the code and the recommended fix.
After the fixes, the final report states for each point whether it is fixed, mitigated, or accepted by your team in full knowledge of the risk. You are free to share it with your partners.
Afterwards, we can help during deployment and check that the code published on the blockchain matches the audited version. Future changes can be audited in the same way.
The limits of an audit, and what to check
- 01
No audit is infallible
An audit greatly reduces risk, but it cannot prove that no vulnerability exists. Be wary of anyone who claims otherwise.
- 02
A frozen version
The audit applies to the code reviewed. Any later change needs reviewing too.
- 03
The code actually deployed
Check that the published contract matches the audited version. Publishing verified source code lets anyone confirm it.
- 04
Admin privileges
A technically sound contract is still risky if a single key can change everything. The audit should say so.
- 05
Existing tests
Well-tested, well-documented code can be audited faster, and in greater depth.
What drives the cost of a smart contract audit
The quote is prepared after a first look at the code to be audited. It depends mainly on these points.
- 01
Size of the code
The number of contracts and lines, leaving out well-established standard libraries.
- 02
Complexity
Business logic, interactions between contracts, calculations, upgrade mechanisms.
- 03
External dependencies
Oracles, third-party contracts or bridges between networks need specific analysis.
- 04
Documentation and tests
The more complete they are, the more effective the audit.
- 05
Post-fix reviews
One or more reviews, depending on the volume of changes.
Technologies and methods
- Solidity
- EVM
- Static analysis
- Manual code review
- Automated testing
- OWASP Smart Contract Top 10
Frequently asked questions
Can you audit a contract built by another supplier?
Yes. An independent view is in fact one of the main reasons for an audit. We need the source code, the available documentation and, if possible, the existing tests.
What if the audit finds a flaw in a contract that is already deployed?
It all depends on what the code allows. A pause function built into the contract, migration to a new version, tighter admin rights or closer monitoring. We set out the possible options along with their consequences.
Which contracts do you audit?
Contracts written in Solidity for the EVM, in other words for Ethereum and the many compatible networks.
Is the audit report public?
That is your decision. The report belongs to you. You can keep it confidential, or publish it to build trust with your users and partners.
Does an audit replace automated testing?
No. Tests keep checking that the code does what it should, whereas an audit brings a critical eye at one moment in time. The two work together. If needed, we can help you strengthen your tests.