What is smart contracts security audit and why is it so important?

Paulina Lewandowska

10 Jan 2023
What is smart contracts security audit and why is it so important?

Introduction

You've probably heard of "security audits" if you've ever used a smart contract. Because a blockchain-based system is only as safe as its weakest link, it's crucial for smart contract developers to conduct routine security audits to make sure that their systems are not exposed to threats or flaws that could reveal confidential data. It's critical for developers to comprehend potential security concerns with smart contracts and how to address them to give users a satisfying user experience. Security audits are a key step in the process whether you're creating your own blockchain platform or adding smart contracts to an existing one.

Smart contract security audits

With the terms of the agreement written directly into lines of code, a smart contract is a self-executing contract. Blockchain technology, a decentralized system that securely and openly records transactions, frequently uses them. A comprehensive assessment of the security and dependability of a smart contract is called a smart contract security audit.

A smart contract security audit involves experts examining the code for flaws and making sure the contract works as intended. This procedure is crucial because it aids in identifying any potential contract problems, ensuring that the contract will function properly and securely when applied in practical circumstances. Developers and users can trust that the contract is trustworthy and reliable by conducting a smart contract security audit.

Reasons for smart contract audit

Before creating a smart contract, there are a number of factors to take into account. The primary goal is to guarantee your smart contract's functioning, security, and interoperability with other contracts. A smart contract audit has a number of special advantages, including:

  • Identifying and fixing any bugs or vulnerabilities in the code
  • Ensuring the security of the smart contract and protecting against potential attacks
  • Verifying that the smart contract will function as intended and not cause any unintended consequences or malfunctions.

By conducting a thorough security audit, you can have confidence in the integrity and reliability of your smart contract.

There are three main types of smart contract audits: manual, automated, and hybrid.

  • A manual audit involves a human expert manually reviewing the code and identifying any potential vulnerabilities or weaknesses. This type of audit can be time-consuming but is often considered the most thorough option.
  • An automated audit uses software tools to scan the code for potential issues. While automated audits can be faster than manual audits, they may not catch all potential vulnerabilities.
  • A hybrid audit combines both manual and automated approaches, providing a balance between thoroughness and efficiency. By using both human expertise and automated tools, a hybrid audit can provide a comprehensive assessment of the smart contract's security and functionality.

Ultimately, the type of audit you choose will depend on your specific needs and resources.

Steps involved in a smart contract audit

  • Code review: The auditor thoroughly examines the code during this stage to find any potential problems or weaknesses.
  • Static analysis: The auditor conducts a static analysis of the code using a variety of tools to search for errors and security flaws.
  • Dynamic analysis: To assess the smart contract's performance and check that it performs as intended, the auditor runs tests on it.
  • Testing: To find any mistakes that might occur during execution, the auditor tests the smart contract using a variety of tools under actual business settings.

These stages will enable the auditor to offer a thorough evaluation of the security, usability, and overall effectiveness of the smart contract

Smart contract audit checklist

To ensure the security and dependability of the contract, it's crucial to take a number of variables into account when conducting a smart contract audit. Here are some crucial factors to bear in mind during the audit process:

  • Common errors: The auditor will look for any harmful code or defects that could allow attackers to modify the terms of the smart contract code and obtain money or information.
  • Known vulnerabilities: The auditor will look for any flaws in the Ethereum platform that have been publicly disclosed and which could result in security breaches or other problems with the smart contract code.
  • Exploits that might be used: The auditor will assess whether there are any feasible methods that a hacker might use the smart contract system to his advantage and possibly steal money.

Importance of auditing a smart contract

Although smart contracts are a ground-breaking technology, they must be properly tested and confirmed before being utilized in the real world because, like any software, they are not flawless. The value of security testing is becoming increasingly clear as the use of smart contracts increases. Working with an expert auditor who is familiar with the nuances of smart contracts and who can see any potential weaknesses or vulnerabilities is crucial for this reason. You can be sure that your smart contract is secure and reliable and eliminate any future risks or problems by completing a thorough audit.

You may find a more in-depth article on this subject that Nextrope has already published here.

Conclusion

In conclusion, security audits of smart contracts are an essential component of blockchain development. They aid programmers in making sure their code is safe, capable of withstanding attacks during periods of high traffic, and scalable enough to meet demand over time. You and your team can find any possible problems and fix them before they have an impact on usability and perhaps turn away clients by routinely inspecting any new applications before release. Security audits of smart contracts are crucial to preserving your platform's dependability and integrity.

Most viewed


Never miss a story

Stay updated about Nextrope news as it happens.

You are subscribed

Aethir Tokenomics – Case Study

Kajetan Olas

22 Nov 2024
Aethir Tokenomics – Case Study

Authors of the contents are not affiliated to the reviewed project in any way and none of the information presented should be taken as financial advice.

In this article we analyze tokenomics of Aethir - a project providing on-demand cloud compute resources for the AI, Gaming, and virtualized compute sectors.
Aethir aims to aggregate enterprise-grade GPUs from multiple providers into a DePIN (Decentralized Physical Infrastructure Network). Its competitive edge comes from utlizing the GPUs for very specific use-cases, such as low-latency rendering for online games.
Due to decentralized nature of its infrastructure Aethir can meet the demands of online-gaming in any region. This is especially important for some gamer-abundant regions in Asia with underdeveloped cloud infrastructure that causes high latency ("lags").
We will analyze Aethir's tokenomics, give our opinion on what was done well, and provide specific recommendations on how to improve it.

Evaluation Summary

Aethir Tokenomics Structure

The total supply of ATH tokens is capped at 42 billion ATH. This fixed cap provides a predictable supply environment, and the complete emissions schedule is listed here. As of November 2024 there are approximately 5.2 Billion ATH in circulation. In a year from now (November 2025), the circulating supply will almost triple, and will amount to approximately 15 Billion ATH. By November 2028, today's circulating supply will be diluted by around 86%.

From an investor standpoint the rational decision would be to stake their tokens and hope for rewards that will balance the inflation. Currently the estimated APR for 3-year staking is 195% and for 4-year staking APR is 261%. The rewards are paid out weekly. Furthermore, stakers can expect to get additional rewards from partnered AI projects.

Staking Incentives

Rewards are calculated based on the staking duration and staked amount. These factors are equally important and they linearly influence weekly rewards. This means that someone who stakes 100 ATH for 2 weeks will have the same weekly rewards as someone who stakes 200 ATH for 1 week. This mechanism greatly emphasizes long-term holding. That's because holding a token makes sense only if you go for long-term staking. E.g. a whale staking $200k with 1 week lockup. will have the same weekly rewards as person staking $1k with 4 year lockup. Furthermore the ATH staking rewards are fixed and divided among stakers. Therefore Increase of user base is likely to come with decrease in rewards.
We believe the main weak-point of Aethirs staking is the lack of equivalency between rewards paid out to the users and value generated for the protocol as a result of staking.

Token Distribution

The token distribution of $ATH is well designed and comes with long vesting time-frames. 18-month cliff and 36-moths subsequent linear vesting is applied to team's allocation. This is higher than industry standard and is a sign of long-term commitment.

  • Checkers and Compute Providers: 50%
  • Ecosystem: 15%
  • Team: 12.5%
  • Investors: 11.5%
  • Airdrop: 6%
  • Advisors: 5%

Aethir's airdrop is divided into 3 phases to ensure that only loyal users get rewarded. This mechanism is very-well thought and we rate it highly. It fosters high community engagement within the first months of the project and sets the ground for potentially giving more-control to the DAO.

Governance and Community-Led Development

Aethir’s governance model promotes community-led decision-making in a very practical way. Instead of rushing with creation of a DAO for PR and marketing purposes Aethir is trying to make it the right way. They support projects building on their infrastructure and regularly share updates with their community in the most professional manner.

We believe Aethir would benefit from implementing reputation boosted voting. An example of such system is described here. The core assumption is to abandon the simplistic: 1 token = 1 vote and go towards: Votes = tokens * reputation_based_multiplication_factor.

In the attached example, reputation_based_multiplication_factor rises exponentially with the number of standard deviations above norm, with regard to user's rating. For compute compute providers at Aethir, user's rating could be replaced by provider's uptime.

Perspectives for the future

While it's important to analyze aspects such as supply-side tokenomics, or governance, we must keep in mind that 95% of project's success depends on demand-side. In this regard the outlook for Aethir may be very bright. The project declares $36M annual reccuring revenue. Revenue like this is very rare in the web3 space. Many projects are not able to generate any revenue after succesfull ICO event, due to lack fo product-market-fit.

If you're looking to create a robust tokenomics model and go through institutional-grade testing please reach out to contact@nextrope.com. Our team is ready to help you with the token engineering process and ensure your project’s resilience in the long term.

Quadratic Voting in Web3

Kajetan Olas

04 Dec 2024
Quadratic Voting in Web3

Decentralized systems are reshaping how we interact, conduct transactions, and govern online communities. As Web3 continues to advance, the necessity for effective and fair voting mechanisms becomes apparent. Traditional voting systems, such as the one-token-one-vote model, often fall short in capturing the intensity of individual preferences, which can result in centralization. Quadratic Voting (QV) addresses this challenge by enabling individuals to express not only their choices but also the strength of their preferences.

In QV, voters are allocated a budget of credits that they can spend to cast votes on various issues. The cost of casting multiple votes on a single issue increases quadratically, meaning that each additional vote costs more than the last. This system allows for a more precise expression of preferences, as individuals can invest more heavily in issues they care deeply about while conserving credits on matters of lesser importance.

Understanding Quadratic Voting

Quadratic Voting (QV) is a voting system designed to capture not only the choices of individuals but also the strength of their preferences. In most DAO voting mechanisms, each person typically has one vote per token, which limits the ability to express how strongly they feel about a particular matter. Furthermore, QV limits the power of whales and founding team who typically have large token allocations. These problems are adressed by making the cost of each additional vote increase quadratically.

In QV, each voter is given a budget of credits or tokens that they can spend to cast votes on various issues. The key principle is that the cost to cast n votes on a single issue is proportional to the square of n. This quadratic cost function ensures that while voters can express stronger preferences, doing so requires a disproportionately higher expenditure of their voting credits. This mechanism discourages voters from concentrating all their influence on a single issue unless they feel very strongly about it. In the context of DAOs, it means that large holders will have a hard-time pushing through with a proposal if they'll try to do it on their own.

Practical Example

Consider a voter who has been allocated 25 voting credits to spend on several proposals. The voter has varying degrees of interest in three proposals: Proposal A, Proposal B, and Proposal C.

  • Proposal A: High interest.
  • Proposal B: Moderate interest.
  • Proposal C: Low interest.

The voter might allocate their credits as follows:

Proposal A:

  • Votes cast: 3
  • Cost: 9 delegated tokens

Proposal B:

  • Votes cast: 2
  • Cost: 4 delegated tokens

Proposal C:

  • Votes cast: 1
  • Cost: 1 delegated token

Total delegated tokens: 14
Remaining tokens: 11

With the remaining tokens, the voter can choose to allocate additional votes to the proposals based on their preferences or save for future proposals. If they feel particularly strong about Proposal A, they might decide to cast one more vote:

Additional vote on Proposal A:

  • New total votes: 4
  • New cost: 16 delegated tokens
  • Additional cost: 16−9 = 7 delegated tokens

Updated total delegated tokens: 14+7 = 21

Updated remaining tokens: 25−21 = 425 - 21 = 4

This additional vote on Proposal A costs 7 credits, significantly more than the previous vote, illustrating how the quadratic cost discourages excessive influence on a single issue without strong conviction.

Benefits of Implementing Quadratic Voting

Key Characteristics of the Quadratic Cost Function

  • Marginal Cost Increases Linearly: The marginal cost of each additional vote increases linearly. The cost difference between casting n and n−1 votes is 2n−1.
  • Total Cost Increases Quadratically: The total cost to cast multiple votes rises steeply, discouraging voters from concentrating too many votes on a single issue without significant reason.
  • Promotes Egalitarian Voting: Small voters are encouraged to participate, because relatively they have a much higher impact.

Advantages Over Traditional Voting Systems

Quadratic Voting offers several benefits compared to traditional one-person-one-vote systems:

  • Captures Preference Intensity: By allowing voters to express how strongly they feel about an issue, QV leads to outcomes that better reflect the collective welfare.
  • Reduces Majority Domination: The quadratic cost makes it costly for majority groups to overpower minority interests on every issue.
  • Encourages Honest Voting: Voters are incentivized to allocate votes in proportion to their true preferences, reducing manipulation.

By understanding the foundation of Quadratic Voting, stakeholders in Web3 communities can appreciate how this system supports more representative governance.

Conclusion

Quadratic voting is a novel voting system that may be used within DAOs to foster decentralization. The key idea is to make the cost of voting on a certain issue increase quadratically. The leading player that makes use of this mechanism is Optimism. If you're pondering about the design of your DAO, we highly recommend taking a look at their research on quadratic funding.

If you're looking to create a robust governance model and go through institutional-grade testing please reach out to contact@nextrope.com. Our team is ready to help you with the token engineering process and ensure that your DAO will stand out as a beacon of innovation and resilience in the long term.