✅Notes
Manual code review: is required to understand business logic and detect vulnerabilities in it.
Automated analyzers do not understand application-level logic and their constraints. They are limited to constraints/properties of Solidity language, EVM or Ethereum blockchain.
Manual analysis of the code is required to detect security-relevant deviations in implementation vis-a-vis the specification or documentation.
Auditors may need to infer business logic and their implied constraints directly from the code or from discussions with the project team and thereafter evaluate if those constraints/properties hold in all parts of the codebase.
Manual review approaches: Auditors have different approaches to manual reviewing smart contract code for vulnerabilities.
Starting with access control
Starting with asset flow
Starting with control flow
Starting with data flow
Inferring constraints
Understanding dependencies
Evaluating assumptions
Evaluating security checklists
Last updated
