The Auditor's Mindset

What you'll learn

• Why Auditing Is Different From Writing
• Reading Code Adversarially
• Threat Modeling: What Are You Defending?
• The 80/20 of Finding Real Bugs
• The Audit Firm Landscape
• What a Real Audit Looks Like

Key terms

Adversarial reading

The practice of reading code from the perspective of an attacker — questioning every assumption, every external call, every access modifier — rather than trusting the author's intent.

Threat model

A structured analysis of what assets a system holds, who the actors are, what entry points exist, what invariants must hold, and what attacker paths might violate them.

Invariant

A property that must always be true regardless of the sequence of legal calls made against a contract. Auditing is in large part a search for sequences of calls that violate stated or implicit invariants.

Code4rena

A contest-based audit platform launched in 2021 where dozens of independent researchers compete on a public codebase for a shared prize pool, with payouts based on severity of findings.

Sherlock

A contest-based audit platform launched in 2022 that includes a coverage model with payouts for bugs missed during the engagement, providing a form of post-audit insurance.

Immunefi

The largest crypto-native bug bounty platform. In June 2024 announced crossing $100 million in cumulative payouts; individual bounties for critical bugs can reach $1-10 million.

Spearbit

A distributed audit network founded in 2022 that assembles teams of independent senior researchers per engagement rather than employing them full-time. Known for high-end DeFi engagements.

Cyfrin / Updraft

Audit firm founded by Patrick Collins, also the creator of the widely-used Cyfrin Updraft (formerly freeCodeCamp Solidity course) — the most common entry point for new auditors today.

Audit-week

The common pricing unit for traditional audits: one auditor working full-time for one week. Senior-auditor-weeks at top firms typically price in the $15,000-$30,000 range, driving overall engagement costs.

Mid-audit checkpoint

A standard practice where auditors share preliminary findings with the team partway through the engagement, catching miscommunication about intent and surfacing the most material issues early.