The Auditor's Mindset

Reading code adversarially. Threat modeling. The 80/20 of finding real bugs, the audit firm landscape, and what good audits cost.

30 min · expert · part of Smart Contract Security & Auditing

Why Auditing Is Different From Writing

Writing a smart contract is an exercise in making something work. Auditing one is an exercise in making something break. The first mindset asks, "How do I get from point A to point B?" The second asks, "What can I do to this code that the author never imagined?" These are not the same skill. Most developers who try to audit their own code do a poor job of it, not because they lack ability but because they are mentally invested in the design they already produced. A good auditor approaches code the way a chess player approaches a position the opponent just played: with no loyalty to the moves that got it there, just an honest assessment of which squares are weak. In traditional software, a bug usually means a crash, a wrong answer, or a slow response. In smart contracts, a bug typically means **funds are gone forever**. The contract is the bank vault and the bank teller simultaneously, with no FDIC, no chargeback, and no human in the loop to say "wait, that doesn't look right." Once a malicious transaction is mined, the loss is final. This is why the discipline of auditing — reading code adversarially, looking for the gap between what the author intended and what the code actually permits — is the highest-leverage skill in crypto engineering. It is also why audit firms charge what they charge, and why protocols that skip audits keep ending up on the Rekt leaderboard.

Also in this lesson

Reading Code Adversarially
Threat Modeling: What Are You Defending?
The 80/20 of Finding Real Bugs
The Audit Firm Landscape
What a Real Audit Looks Like

Key terms

Adversarial reading: The practice of reading code from the perspective of an attacker — questioning every assumption, every external call, every access modifier — rather than trusting the author's intent.
Threat model: A structured analysis of what assets a system holds, who the actors are, what entry points exist, what invariants must hold, and what attacker paths might violate them.
Invariant: A property that must always be true regardless of the sequence of legal calls made against a contract. Auditing is in large part a search for sequences of calls that violate stated or implicit invariants.
Code4rena: A contest-based audit platform launched in 2021 where dozens of independent researchers compete on a public codebase for a shared prize pool, with payouts based on severity of findings.
Sherlock: A contest-based audit platform launched in 2022 that includes a coverage model with payouts for bugs missed during the engagement, providing a form of post-audit insurance.
Immunefi: The largest crypto-native bug bounty platform. In June 2024 announced crossing $100 million in cumulative payouts; individual bounties for critical bugs can reach $1-10 million.
Spearbit: A distributed audit network founded in 2022 that assembles teams of independent senior researchers per engagement rather than employing them full-time. Known for high-end DeFi engagements.
Cyfrin / Updraft: Audit firm founded by Patrick Collins, also the creator of the widely-used Cyfrin Updraft (formerly freeCodeCamp Solidity course) — the most common entry point for new auditors today.
Audit-week: The common pricing unit for traditional audits: one auditor working full-time for one week. Senior-auditor-weeks at top firms typically price in the $15,000-$30,000 range, driving overall engagement costs.
Mid-audit checkpoint: A standard practice where auditors share preliminary findings with the team partway through the engagement, catching miscommunication about intent and surfacing the most material issues early.

Continue this lesson — 5 more sections in the CryptoBipto app.

Open lesson

Educational only — not financial advice.