Smart contract audit best tools and practices
Tags: ethereum, blockchain, testing, programming
Published: 2018-02-05 12:10:11

---
layout: post
title: "Smart contract audit best tools and practices"
published: true
tags: ethereum, blockchain, testing, programming
cover_image: "https://thepracticaldev.s3.amazonaws.com/i/zct1jcd4omg3zsal135o.jpg"
---


When building an Ethereum project, focus on smart contract security and code quality. Otherwise, you may lose huge money. For Instance, Parity Ethereum wallet lost $30 million because of code vulnerabilities. 

For this reason, Satoshi Pie fond lost 32,4% of its assets. In 2016, the attacker hacked the DAO and took away $50 million.

These examples clearly show that even a slight mistake or defect in the smart contract logic can lead to bad results. That’s why smart contract audit is an essential part of smart contract development.

The goal of this stage is to identify code errors and check the program logic. A high-quality thoughtful audit will allow you to remove risks, anxiety, and save your nerves and resources. 


Find out </span><a href="https://smartym.pro/blog/ethereum-blockchain-platform-delving-into-smart-contract-development/"><span style="font-weight: 400;">how to develop smart contracts</span></a><span style="font-weight: 400;"> and then </span><a href="https://smartym.pro/blog/developing-smart-contracts-smart-contract-audit-best-practices/"><span style="font-weight: 400;">prepare for smart contract audit</span></a><span style="font-weight: 400;">.



<h3>The process of smart contract audit</h3>
 

The process of smart contract audit is similar to testing of any other code: a set of standard method calls is created in the predefined environment, and statements are written for their results. The audit is a complicated process that includes:


<b>Test development</b>

- Testing of smart contract state changes
- Event testing
- Error testing
- Checking a messages’ sender


Though the test development in </span><a href="https://solidity.readthedocs.io/en/develop/"><span style="font-weight: 400;">Solidity</span></a><span style="font-weight: 400;"> is limited to the capabilities of this programming language, in our work we also use JavaScript, Truffle framework, Parity, and other proven technologies.

 

<h3>Smart contract testing with Truffle</h>
 

Now </span><a href="https://github.com/trufflesuite/truffle"><span style="font-weight: 400;">Truffle</span></a><span style="font-weight: 400;"> is the most popular framework for Ethereum. 

Truffle is a Node.js framework used to compile, link, and deploy smart contracts. The framework is written in a completely modular way enabling engineers to choose the functionality they need.

While in Truffle v.2 tests are created on JavaScript, in Truffle v.3 developers added the ability to write tests on Solidity, whose syntax is similar to that of JavaScript.

Truffle offers a lot of useful features including binary management, library linking, custom deployment support, migrations framework, scriptable deployment, access to hundreds of external packages, external script runner, and automated contract audit with Mocha and Chai.  

Considering the fact that Blockchain systems don’t work very fast, auditors use Blockchain test clients, for example, TestRPC that almost completely emulates the work of the </span><a href="https://github.com/trufflesuite/truffle"><span style="font-weight: 400;">JSON RPC API</span></a><span style="font-weight: 400;"> of Ethereum clients.

Besides standard methods, </span><a href="https://github.com/ethereum/wiki/wiki/JSON-RPC"><span style="font-weight: 400;">TestRPC</span></a><span style="font-weight: 400;"> also implements a number of additional ones, such as <i>evm_increaseTime</i> and <i>evm_mine</i>. 

A good alternative to applying TestRPC is to use one of the standard clients, for instance, Parity, that runs in dev mode and has transactions instantly confirmed. 
 

<b>To start working with Truffle framework install it via npm:</b>
 
<i>npm install -g truffle</i>
 

Then, perform the truffle init command in order to create the project structure: 
 
<i>$ mkdir solidity-test-example</i>
<i>$ cd solidity-test-example/</i>
<i>$ truffle init</i>
 

Contracts must be located in the contracts/ directory and tests – in the test/ directory. When you compile contracts, Truffle expects that each contract is placed in a separate file, and the contract name is equal to the file name.



Learn <b></span><a href="https://smartym.pro/blog/developing-smart-contracts-smart-contract-audit-best-practices/"><span style="font-weight: 400;">how to develop tests in Truffle, how to audit events and changes in smart contracts, and what are other useful testing tools.</span></a><span style="font-weight: 400;"></b>