@pks_
Last updated
Last updated
When auditing an unfamiliar codebase, it's essential to thoroughly review related third-party codebases first. For instance, when auditing a new chain based on Cosmos SDK and Geth, you should:
Study key APIs like Cosmos SDK's PrepareProposal/ProcessProposal/FinalizeBlock/ExtendVote/VerifyVoteExtension functions.
Understand Geth's block generation/verification/processing steps.
Research known vulnerabilities discovered by other security experts.
Thoroughly review the attack path firstly.
Take a break, then review it again with fresh eyes.
If the vulnerability still holds after double review, develop a Proof of Concept (PoC).
Remember that ideas often rely on assumptions that may be incorrect, especially in complex codebases. Following this systematic approach helps build experience and reduces errors in future audits.
This approach helps you understand both the complete code flow and potential security risks, providing valuable insights for your audit
