Standards for Smart Contract Security Audits

Introduction

The Smart Contract Security Alliance’s core mission is to support healthy growth and adoption of blockchain applications. As part of that, we are working with other members of the industry to develop accepted standards for creating and evaluating the security of smart contracts.

We’ve published our recommended standards here to help customers understand what they are buying when they purchase a security audit, and to increase the level of professionalism in the field. We believe the standardization of security evaluations will facilitate compatibility, accountability, interoperability, research, and credibility for all industry participants.

Members of the Alliance

Smart Contract Vulnerability Severity Levels

Smart contracts vulnerabilities are categorised according to a potential severity or business impact. Since it is not possible to define every possible condition or technical situation, these guidelines can only provide guidance.

Level

Explanation

High

The issue puts the vast majority of, or large numbers of, users’ sensitive information at risk, or is reasonably likely to lead to catastrophic impact for client’s reputation or serious financial implications for client and users.

Medium

The issue puts an subset of individual users’ sensitive information is at risk, exploitation would be detrimental for the client’s reputation, or is reasonably likely to lead to moderate financial impact.

Low

The risk is relatively small and could not be exploited on a recurring basis or is a risk the client has indicated is not important or impactful in view of the client’s business circumstances.

Informational

The issue does not pose an immediate threat to continued operation or usage, but is relevant for security best practices, software engineering best practices, or defensive redundancy.

Undetermined

A condition noted during the audit where the impact of the condition is uncertain based upon the findings in the audit.

Preparing Your Smart Contract

Before you start writing your smart contract, there are a few questions you should define:

Articulate in your words clearly what exactly your smart contract is intended to do and what features it has.

Identify your target date of your audit completion and any reasons for such timing. As code complexity may increase the time associated with a complete audit, be cognizant of the pressure deadlines may hold.

Provide the location of your source code, preferably GitHub with the commit hash to be audited, and access to auditors, including any associated credentials, requirements, orterms.

How to Deploy Your Smart Contract

Before you start writing your smart contract, there are a few questions you should define:

For the token contract, provide the following parameter information: name, symbol, decimals, and supply.

Will these tokens have an open mint? When is your target sale date? The smart contracts audit for token/crowdsale should be done at least 2 weeks prior to sale.

Will these be burnable tokens? If so, under what circumstances do you anticipate tokens being burned?

Guide to Defending Your Smart Contract from Attacks

Before you start writing your smart contract, there are a few questions you should define:

Secure list of people with access to company multisig wallet. Ethereum addresses assigned ownership to multisig wallet.

List of mnemonic passwords (if any) stored, in a highly secure, offline location. Secure list of people with access to company website hosting server.

Secure list of admin accounts for social networks such as Slack, Facebook, Twitter, etc. Two Factor Authentication (2FA) enabled on website hosting server.

The Standards forSmart ContractSecurity

Introduction

Members of the Alliance

Smart Contract Vulnerability Severity Levels

Preparing Your Smart Contract

How to Deploy Your Smart Contract

Guide to Defending Your Smart Contract from Attacks

Subscribe to our Newsletter

For questions, or to apply to join the alliance:

The latest alliance news, articles, and resources, sent straight to your inbox every month.

The Standards for
Smart Contract
Security