GTDA Method for Smart Contract Auditing: Finding Critical Bugs

[00:00:00]I showed seven security researchers how to audit and uncover critical bugs with a method that I like to call the gtda method and now of course I'm bringing this training to you so that you can go and you can use this method to audit protocols and find hopefully as many critical bugs as possible so in this video we're going to cover what are the the steps of gtda what what does gtda even mean what does it stand for and then you're going to get to see the questions that the security researchers asked me about the method and how they could implement it into their workflow and so hopefully you can take this and you can take the the answers I gave to their questions and you can use it to implement it in your own auditing approach and hopefully it will give you exactly what you need to find as many high and critical vulnerabilities as possible so of course before we jump into the gtda method my name is own and over two years ago now I founded Guardian Audits and ever since then we've uncovered dozens and dozens and dozens and and even over a 100 different critical vulnerabilities to this date and we've done that by auditing over a thousand different smart contracts and personally I've spent probably a few thousand hours at this point auditing smart contracts and so my goal with this Channel and and all the videos that I put out and especially this one is to give you everything that I've experienced thus far and to still it down give it to you so that you can ultimately become a much much more effective security-minded blockchain engineer blockchain security researcher whatever it is you're looking to be in a fraction of the time so with that being said let us get into the gtda method and see how can we improve our auditing approach and how can you find critical vulnerabilities as effectively as possible let's get into it So today we're going to go through really the high level approach that we have been developing for the past I guess two years now of how to to effectively audit and how to not get overwhelmed how to dig in and and do the right things at the right time um when you're in the midst of an audit and we're going to introduce the gtda system that we have developed at guardian and we're going to we're going to learn what each of those are but before we even get into the gtda system I'm going to talk about some you know high level things about auditing that inform how we approach it and then also just talk about you know how do we audit effectively efficiently and and everything like that so first of all I want to talk about what vulnerabilities commonly are like I think there's a a common misunderstanding that security is oh I just go and I learn what the types of vulnerabilities are and then I can go and find stuff and code bases now there's some truth to that but I would say that you know that's really not what vulnerabilities are at the Crux of you know at least in our experience what we find at Guardian it's not like you can just go and learn stuff so we'll talk about that we'll talk about what vulnerabilities commonly are uh what kind of skills you need to have there and then we're going to get into how do we approach auditing first of all in a in a sense of being productive with our time and getting the most out for the work that we put in and then we're going to follow that with a full rundown of the gtda system which we've developed at guardian and then we're going to walk through exactly what you should do when we're approaching the ethern note prepared audit so the approach that you guys can take there and then we'll walk through how you guys should be applying gtda to that prepared audit so what are vulnerabilities right like what are when we actually go into a real audit and we actually want to start uncovering vulnerabilities what is that actually going to look like right so I touched on it a little bit already but it is yes it is important to know like this is what a re-entrancy attack is this is what a Dos attack is and you know sort of build out your what I like to call your toolbox of things that you can go in and you can reach in and start to manipulate things and code base and ultimately use that to get findings that is like one piece of having a fully built out toolkit or a fully built out um skill set for finding vulnerabilities so the first thing I'll say here is you know it's not memorization of a bunch of edge cases you know or like you know attacks or anything like this that's one part it's not just memorization of this right that is not what's going to enable you to actually find interesting vulnerabilities especially if you go into a contest right if you go into a contest and you just submit like oh you didn't use safe transfer from or something like this you're going to get like two cents for that right the actual Crux of what are vulnerabilities and how do we actually find them is more often than that you'll see they're just they're just straight up bugs or logical errors right they're just edge cases that are more often than not extremely unique to the code base and they just simply can't be a cookie cutter like system or it's not something you memorize very very rarely does it work out like that because if it's something that you can just memorize and they're just rules then hypothetically you could just put that into an as parser or you could put that into an AI model and they would just solve it for every codebase right but of course nobody has done that yet for smart contract security because that's not the way smart contract security works right there are of course bot Racers and things like that but they get all the the minor issues that we're going to get duped to Hell anyways right so I mean on one hand it kind of sucks that we can't just memorize a bunch of things and then apply them to a code base because it's harder and I mean that's one of the the main reasons why it's it's really hard to scale a really huge security company right if you do you become ceric and everybody knows what happens with cerdic but on the other hand that means that there will always be opportunity for many people to be able to develop this skill and earn a high income live you know the lifestyle that they want etc etc because you can't automate it right it can't be automated by AI it can't be automated by an asop parser and more more importantly one person cannot do 10 audits right so so there's this flattening effect of there will always be opportunity for anybody who has this skill set right because there's a there's like a a bottleneck built into the nature of the service so that's a long way to say that really understanding the code base at a deep level so understanding the code base at a deep level that is the key that's the most manual intensive part of the audit is understanding you know what the developers were thinking why they structured it a certain way and getting over that initial context getting the context of the codebase and then being able to dive in and find oh here are the actual interesting edge cases here are the actual vulnerabilities that will actually affect the system and then you'll actually be able to see what the net effect is right so of course how do we actually come to be able to understand these code bases at a deep level well we need to of course understand what is the thing doing we need to understand that goal at a deep level right so of course that's a part of what we're doing with cdps right we need to understand the the actual defy concept of what it is at a deep level and then now you guys will start to see when we start looking at other CDP code bases now that you guys have gone through the steps of deriving this thing from first princi principles you're going to have a look at another CDP code base and you're going to see oh this is different than how I thought through it and oh that that seems off we handle this Edge case or you know they're not thinking about this or something like this right so understanding these defi Concepts really in depth right and being able to to really touch and feel the the formulas and understand why things are at a base level right this this is really the core of where vulnerabilities are now on top of this we do want to actually go and build out our toolbox because we'll we'll see how our toolbox actually becomes useful in just a minute but really we need to be able to get to a point where we can get into any codebase get to understand it as fast as possible then and only then can you actually leverage your toolbox of you know edge cases and attacks that you personally know of to actually go and break stuff so before we move on to auditing approach in terms of productivity do you guys have any questions on that section there um yeah I have a question yeah absolutely go ahead so by understanding the code base uh do you mean that we should know how a how protocol should be implemented securely and then now that we know that what are the where the things can go wrong when we audit other protocols we can p that pattern yeah it's not even necessarily that we should know this is what it looks like when it's secure it's just so that we should know this is what this protocol is trying to do and this is why it's trying to do it right so we need to understand if I come and ask you to audit a perpetuous protocol it would be a lot more helpful if you previously had experience diving into perpetuals and understanding it from first principles and the best way to understand perpetuals and to not like like I can tell you what perpetuals is can give you the formulas behind it and I can walk you through examples but that is a surface level understanding right you need to actually go and take that and apply that to code so that you can see oh this is literally how you know this works or this is the issue that you run into when you try to decrease the position and account for fees and stuff like this right so it's not literally I know what this looks like when it's secure it is I know what this looks like in general right I I understand what this protocol is and what it's trying to do so I guess does does that make sense yeah yeah got it thank you yeah and and that way you'll just be able to dive into the code base without some initial fog already right so the the number one enemy that we have as Auditors is the fog when we dive into a no code base I really think auditing is just the skill of reading and understanding defi code basis that's really all it is then on the back of that you add an attacker's mindset and a a toolbox of potential vulnerabilities that's the easy and fun part the hard part is understanding the code base and then you know getting everything mapped out and having a mental model for things and then you get to have fun you get to be creative and you get to actually find the cool bugs so the Cod bases we have looked at we you know we can AUD similares faster like get into the Atta mindset faster right because how should work yeah and that's that's where all the ROI is right so as soon as you get over the the period of understanding a codebase that's when you can actually start finding stuff right I'm sure you guys if you've hopped into some contests you might have spent some time and been like this looks like it's wrong but I have no idea if it's wrong or you know something like that it's like I don't know if this is a finding that's a sign of you're you're still in that first phase of you know getting to to understand a code base right so as soon as we can get out of that phase and get into the the second phase which is an understanding and now thinking about those edge cases and using your toolbox that's where the findings are made that's where the money is made that's where the results are delivered so our enemy is that initial barrier to get into that phase so yeah that's a great question yeah so let's first of all just talk about audit productivity before we talk about the actual approach to to auditing and the the gtda a system so first of all this should just be you know Baseline is just to remove all distractions and this is extremely important right if you have Discord open and you're getting pinged left and right this happens to me all the time it's extremely hard to get into a point of focus and I find that if I am distracted I can spend like five hours and literally not break through any barriers but in 1 hour of completely focused time I can really dig in and absolutely crush a code base like absolutely be able to walk through and start understanding things way faster right and and building the mental models that are necessary way faster so first of all just removing all distractions right I'm sure you know that is more of an obvious thing but it is like I can't overstate it enough just have only the the codebase window and then maybe a notepad we'll get into how we use that but yeah no no distractions okay second of all is to have you know sessions like have blocks of time periods of time where you're like I'm doing this right now right you're either doing it and you're doing it 100% or you're not doing it you're not kind of doing it watching TV you got TV on the background no just if if you're going to be auditing that is time that you're spending auditing and actually making progress and then when you're not you're you're relaxing you're you know you're cooling off afterwards like those two things right there will see a huge boost in in your performance and your ability to start to understand these code bases I can personally guarantee that so what I like to do is I like to have 60 Minute sessions um I like to have a timer so if it gives you anxiety you might not choose to have a timer but I like to have a timer it just reminds me every time I start to feel my mind wandering when it sometimes when you start to approach something in the code base it's like ooh that's kind of kind of hard I don't want to think about that your mind starts to wander and if you actually pay attention you watch it you can start to see exactly when that starts to happen to you you know you might come up against some math or you have to start thinking about decimals you know and man those are not the easy things to think about right I got to get out of whiteboard I got to start working through this stuff right so I got to catch myself and having that timer ticking for me just helps me be you know in the moment and aware when my mind starts to kind of shy away and oh I don't want to think about that I want to go think about this let me go think about some other irrelevant stuff so figuring out when your mind starts to do that and dragging yourself back and sort of pushing through those hard steps that is that is key and having a timer personally helps me with that so you might consider actually having a timer and then finally I'll say we need to set goals right we need to set goals and have a notepad during our our session so you saw me do this with uh kelp the the live session that we did last week this has been absolutely key to like we said with the sessions just orienting me and making sure I'm not wandering through the code base and keeping me on track right because the the number one enemy to getting over the context phase is just not being effective and not knowing what to do and it's very easy to get lost when you open a code base and it's like 8,000 lines of code right I you don't you don't even know where to start right so you just start Meandering that's just a waste of time right you're you're literally not not achieving any set goals you're kind of just glazing over the code we want to avoid that as much as possible so the third thing I'll add here is we want to set goals and and have a notepad so any any questions on that does do those make sense to folks Yes sounds perfectly reasonable I would say great great and once again I also put all of this in school so you guys will have all of these notes uh after we finish and then also this will be recorded as well yeah what's up so like they say you have a 60 Minute session and I don't know like last five minutes you find something big like do you still like go away and relax a little bit or you like I don't know just keep going oh I'm an animal I'll just uh so I'll set the timer for 60 minutes then when it gets to zero I'll just set it back at 60 minutes and I'll do that like three times in a row so really I'll go like 3 hours in a row sometimes that's when we're really busy and stuff's got to get freaking done um so yeah I mean if I personally if I'm in the middle of something I'll just set the timer back up I'll do another session but um I mean that's that's up to you you know everybody has their different capacity of like okay I after I do an hour I'm burnt um I need to step away for 5 10 15 minutes so if that's you I would say figure out what works best for you right of course if I'm in the middle of something and you know I'm hooked and I'm feeling I'm feeling it and you know I'm feeling progress don't stop it right why why force it to stop but I I think definitely if you're not in a place where you're in the middle of something then yeah stop take five minutes take 10 minutes and uh and and come back after you've you know maybe you've had something to eat or just had some time to to it out maybe go for a walk or something like that clear your mind and then you can come back you can be super effective so I'm I'm not super strict with it in terms of the timer is up I'm done but it just helps me to see that time is ticking down and it's time to be focused but I guess does that answer your question yep thanks okay cool cool yeah and also on the notepad so we I'll just actually go and write out what an example notepad that I use this is just always a setup that I use use we can write that out um and of course I mean just figure out what what works for you but this is what I like to have is you know first of all have goals at the top and we'll see exactly how we how we go through and assign goals and stuff and then just have a section for notes and finally findings and so throughout my sessions we at guardian we track our findings in Discord we open like a thread and you guys will see um as we continue on how we do that so I used to have Discord open to to be able to put findings in as I got them but um it's distracting you know when you hear that little like notifications on so I just I keep all of my findings tracked here so I'll like go and I'll say like oh something in the exchange router online 102 and then here's the description dot dot dot and then here's the recommendation dot dot dot and then at the end of my session I'll go and I'll copy and paste all these in into threads in Discord just so I don't have to have Discord open but uh yeah this is what my notepad usually looks like so let's get into the gtda system so when we're first getting into an audit the we need to get over this initial phase of understanding the code base so the first thing we need to do is we need to break that down into goals right so just like we we set up here we're going to have goals and and that's going to help you with each session but more importantly this is initially to first get an understanding of the system so your initial goals that you set for your sessions or or or whatever are going to be basically hinged on what does the system do so we'll think like what does the system do break that into features right so if this is is a CDP protocol I know there are some distinct features right there's going to be borrowing capability there's going to be repaying capability there's going to be add collateral remove collateral and there's going to be some liquidation something you know something along the lines of this if it's a CDP protocol I'm expecting to see these five functionalities here right and this this changes based on what type of protocol it is obviously and sometimes you might not even know what the hell you're looking at they're all basic like okay this is borrow lending this is liquid staking but now they're just using more terminology and it's hard to even figure out what each protocol is so honestly to to figure out what a protocol is and what some of these goals are one of the hacks I found is obviously first of all read the docs and uh maybe scan the code but also look at Twitter right I've actually found it really useful like what are they even marketing themselves as like you see if you just hop into the codebase and you're trying to figure out what is this thing it's like often times it's pretty hard to guess like guess this defi protocol by the by the code right so what I found is like yeah just go check out their Twitter go check out their their user facing documentation see what the the users are marketed to be able to do and then write those down right so whatever they're they have in their user documentation on their website those are features right so if you go on their website and you notice that there's lending okay well well there's a feature right people are probably able to borrow and you know somebody's actually lending that out those are features to write down so the goals initially are just features of the system right I want to go and I want to figure out how do these things work in the code next what I'll do is I'll of course briefly read through the docs I don't spend too much time in the docs just to understand a little a little bit more on each of these goals whatever information they have and then also scan the code I want to just get a look at all of the files individually just have a look at you know what's in store I don't want to immediately dive in and be like really up close looking at some liquidate function and like there's all this code around me and I've I've not looked at it but I'm just like really focused in on this liquidate function no personally I found that it's a lot more helpful to scan every single file and just have a look at what kind of functions are in each contract of course I'm not going to have any idea what any of that does right now but just to understand this is where most of the logic is in this contract here or you know this is what we're dealing with over here and also just to be able to scope out and see like okay here's what's on my plate with this audit and uh just get all that out of the way it's kind of like ripping off the bandaid just like okay just let me look at everything that's in scope here so I can get an idea of what we're diving into so these are what my initial goals will be is literally just features of the system and then what I'm going to go and do is I'm going to actually walk through and go through the code paths for each one of these things right so I'm going to start off with probably add collateral is where I would start you know it depends on the system obviously and I'm not going to know exactly where that is right so I'm going to go to the documentation I'm going to see ideally they have some point where it's like this is where users call and then you can go to that contract you can figure out okay this is where they add collateral sometimes documentation sucks right so I'm not going to know where to go so at that point what I'll do is I'll look for something called like a router I'll look for uh I'll honestly just look through all the contracts to see like is there an external function called deposit or you know add collateral stuff like that if you're literally going in blind and the documentation really sucks uh that's what you do you you just have to enumerate all of the external functions and and sort of like feel around until you catch that initial starting point and then you can follow that starting point like a thread and see how this actually happens in the code right so I'll pick up I'll say okay okay this is adding collateral now it's time to actually go through walk through the call Path of like okay this is what contracts are being called This is what logic is being done and actually walking through and getting to know the system this way right this is how we understand the contracts with context right at one point I used to try to just you know read functions and just understand what functions were doing it was way harder because I I was like I didn't know what it was trying to acheve achieve it what it was doing and I didn't know why it was trying to do what it was doing but now if I framed it in this way where I was attacking each thing from the sense of okay we're trying to add collateral with this function now all of a sudden stuff became a lot easier for me in terms of understanding but of course to be able to get that framing we need to have the pre context of okay I I understand D5 systems and I understand this is what adding collateral means and this is why you have to add collateral and stuff like that so you know what to expect right going into these systems the next Point here is of course just walking these code paths right and this is how you accomplish these goals is these goals are basically saying I want to understand how borrowing works I want to understand how repaying works and stuff like this so the that brings us to the next the T here which is tags so as you're walking these code paths you're going to notice things you're going to have questions you're going to think of edge cases none of that is important right now so you want to just make tags for questions potential vulnerabilities you're going to have an idea for an attack as you're walking through and you need to resist digging into that and going into that rabbit hole You you absolutely have to because you're just going to waste a ton of time because you don't know how the system works right now for for so for questions potential vulnerabilities and edge cases just make tags so go at audit make an AT audit tag and just leave that in the code like like you saw me do with the the kelp audit leave that there so that you can grep for it later and come back to that after you understand what's going on in the codebase if you try to dig into uh a particular question you have or an edge case or potential vulnerability at this stage in the audit you're going to end up spending your spinning your wheels and not really going anywhere directly so what I try to do even you know honestly when I open a code base I don't even try to look for vulnerabilities or do anything like that if I notice stuff I'll leave it a tag but my goal is 100% locked in trying to just understand the code and then when I come back to these things these questions vulnerabilities edge cases I can just answer these in like a minute or two because I already or immediately right I'll just know oh yeah well that's actually not an issue because of this or that is an issue and I think I have a knob over here that I can turn to make this an issue when I've combined these two edge cases together or something like this so that is really what we want to use tags for we want to use tags for focusing on getting context putting these tags in our backlog to look into now as we're going through the code base often times if it's a really complex code base we we especially want to do this the third thing is to diagram so often as I'm walking through these these code paths what I'm going to do is actually actually we can go and see uh what some of these diagrams look like I'll go ahead and get some of these up I like to use whimsicle you guys can go to whimsicle you can sign up look here's a here's a diagram I was literally in the middle of making here so right now we are doing an engagement for the GMX V1 system because they're going to be making some updates there so this is the I'm I'm starting to make a diagram here so there's a lot of different paths here GMX V1 is a more complex system it's not the most complex system but it's more complex in that system there's like a central Vault and then there's all these different ways of interacting with the Vault so for example here's a feature here's a a goal that that I had was to understand how to Mint glp right and that's how you basically provide liquidity to be used in the vault so I went through and I walked through the contracts as I was walking through and looking through the the call stack and the execution path I mapped out okay we started in this contract which I had to just kind of figure out then we go to this contract and you know we call this add liquidity for account function and then we we call Buy usdg on the Vault right and I did this for all of these features so here's how create order Works Execute order and uh here's another there's another pathway for executing positions for you know whatever reason but this is uh this is one that's not fully built out yet let's see if I have one for dolomite because Dolomite is Hefty here it is all right so this is Dolomite so this one is Dolomite is probably it's the most confusing complex code base that I've I've had a privilege of looking at they use inheritance to the nth degree they use uh a lot of inheritance with their contracts and stuff so it's very confusing but so I had to go ahead and and map out and say through okay you're going to call this is the entry point to the system you're going to call the Vault and then we're going to call this generic Trader proxy which is in their margin repo we're going to come and we're going to call operate on the Dolomite margin contract and then we're going to come in here and we're going to do these two things uh in that operate function we're going to you know call into this and we're going to do all that that's deposit and then here's withdraw withdraw is even worse so I've got all this all this stuff mapped out here but there is literally no way that I would have all this stuff in my mind without mapping this out right like there's no way right especially when I'm just getting into the system this is the only way I was able to work through it right do it piece by piece like it looks really complex here but I was literally just building this Brick by Brick and that's how we break a code base down a really complex one and make it a lot more digestible so diagrams are huge for breaking a complex code base down and then also having a having an artifact to discuss the code base with others right so you're literally you can hand this to somebody and say he hey here's how I understand the system and they can poke and prod at it they can tell you where you're wrong and also it helps them understand the system right so diagrams are absolutely huge especially if you want to start auditing with a team um that's something that you do once and it benefits everybody and everybody can add to it so diagrams are indispensable once again I recommend using whimsicle I like uh they look pretty clean not this one but uh if if they're more simple they're cleaner now after these first three things this is this is all the painful hard part now we get to the fun part which is to attack right this is the fun one this is the one we all want to get to and this is where we make the money this is where we get the findings but we have you got to go through these first three things first to be able to get over that context phase and you can see this is 75% of the gtda method is getting over the context phase right so that's why we're putting all of our effort and energy into giving you the skills to be able to get over that as fast as possible so now is attack and this is where your toolbox comes in only at the end is it now important that you understand what a re-entrancy attack is that you understand what a Dos attack is and you know things like this so when I said they're they're important but they're not everything this is what I meant right it's the last 25% it's it's the icing on top but you can only get to that and you can only actually use use it once you understand D5 protocols and you understand you know the code base that you're looking at in this moment so after we finished all the initial goals and we've walked through all the paths of the system you should at this point have a really solid understanding of the system now we're going to go back to audit tags so we're going to go back to audit tags and now you're going to have a look at your your edge cases your questions your potential vulnerabilities you're going to you know a ton of them are just going to be straight up invalid after you go back and look at them you're going to be like oh wow I didn't understand this Cod based at all and then cool we can just delete those tags some of them will be interesting so you want to actually go through the interesting ones and explore those further right if you had an initial idea for a reentrancy now is the time to think about that right and actually go through and use your toolbox right at a certain point you're going to get through all of your Auto AIT tags and actually you know basically run out of audit tags and initial questions that you had so now we go through our our second pass and this is where now you start thinking with an attacker's mindset now you start to try to break stuff because you actually understand how things can be broken and how bad that can be right so we're going to do the same thing we're going to follow execution paths and now instead of you know paying attention to how the thing works now we go in much greater detail we go more line by line and really questioning each thing of like okay this parameter is a un 256 now what if I provided zero what if I provided you know the the maximum U value what happens then or you know thinking about these edge cases and taking more time to to think about that and actually try to Break Stuff This is where we use the toolbox so use toolbox and this is something that we're going to be building up especially in weeks 4 through 8 is what we're going to be focusing on building the toolbox so you know the the different types of edge cases and uh things to to use to attack the code base as you actually get into it right so this is where the stuff of like okay you understand Ry you understand dos you understand gas griefing and you know you know Common edge cases is you know to think about you know input zero amounts input single way amounts or like really small amounts you know to look for um stepwise jumps in token values or something like this you know to look for you know all of these things right which we'll we will get to and we will get you all of those uh tools that you need right so so this is the final step of everything and and now at this point this is also when you want to go and Implement your test cases right so as you're going through you you might notice that they have poor test coverage in some areas this is where you want to fill that out or um especially you want to get into the fuzzing which we will we will cover a little bit later on is how to actually break down and and identify invariants and then go and fuzz them and um that is a whole another part of attack that uh is extremely undervalued at least from what I see today fuzzing is just as powerful if not more powerful than manual analysis so fuzzing is um absolutely huge in this attack sector but uh any questions on this attack section and then I guess really the entire gtda method we've gone through so far uh this might be irrelevant to the GBA method but I was wondering what you meant by the stepwise jumps and token value yes yes and this is this is something we will we will get you to see at a at a close-up level uh with some of the stuff we're going to have you work through but uh essentially if I have a system in which rewards are distributed or anything like this you'll see commonly in D5 systems there will be like a share of a pool or you know this applies to many different systems but we'll say there's a pool you you stake into a pool for example I can stake tokens and I get a certain share of the Rewards or the pool value something like this right so let's say I have a a stake in a pool and here's the value and this is time now let's say rewards are added to the pool and the value of the pool goes like this and everybody in the pool who was staking made money well what if I stake right before literally front run it and then unstake right here well I get this Delta of dollars risk-free I didn't have to stake for this whole time I didn't have to stake for this whole time I just staked for this single you know millisecond or I staked for a single block even and I got all that value I can sandwich attack the actual reward compound that happens right here so that's what I mean by stepwise jumps and and we'll get you to actually see what that looks like in practice but that's honestly a very common one because it's just a fundamental problem when we're trying to distribute rewards but does that answer your question yeah cool thank you does that happen in like in unisoft pools like you can just what it add liquidity like if there's like a big swap coming yeah that's I mean that's a whole thing like just in time liquidity right so in Unis swap it's not nearly as uh like as malicious but it is a thing right like it's not distinct reward that are being distributed it's it's fees that are being charged on liquidity but uh yeah just in time liquidity is is a thing yeah like especially let's say3 that maybe you provide liquidity in a very tight range yeah yeah exactly so you get like the most out of it from a big swap Fus that can only occur when those big swaps do exist but yeah that is there's a number of things that are technically toxic about you know Unis swap V3 liquidity provision but uh yeah that is another whole thing that that we can get into but that's another similar application of this right that could honestly be like a a medium finding if you're going to go and audit Unis swap of course they know about it and that's kind of a they're saying it's like a feature but you know it is a downside for LPS yeah so cool let's talk about when we actually go and we go through our prepared audit how we actually want to go and apply this right so first of all you're you've gotten your prepared audit what you're going to do is set aside some time to to work on the prepared audit make sure you have no distractions during this time consider setting a timer or at least just saying for the next two hours I'm going to be doing this set up a notepad right just set it up it could be like this it could be however you want it and then I would say initially go through and get some initial context on the system so just maybe do a once over on the the contract watch the video that we've got for you read through the readme which has a brief overview and then from there you should be able to see here's what the system aims to do now enumerate out all of those high level goals so in the ethern note system you can mint you can redeem things like that those are your initial goals then walk those code paths right go through them understand how it works don't pay attention line by line per se but understand this is what this function is doing and you know these are the important lines of this function now if you notice things you have ideas or edge cases put an audit tag there right and come back to it later and do not get sucked into a rabbit hole until you understand the contracts now this contract is not nearly as big as a full like complex def5 system so um it won't be too hard to get the context but this gets more and more important as the code base gets larger and larger so focus on the context make those tags and for this system it's it's not hugely important to make a diagram because it is a system that you can hold in your brain all at once time lots of other systems are not that way um but maybe it would be good to to get some reps right making a diagram go try out whimsicle or use whatever software you're most familiar with and try to make a diagram of the the flows that happen and that might be helpful and then finally get into attacking now go through your your audit tags go through the interesting ones and really just think about actual developer bugs right the most interesting findings they don't have to do with just an obvious reentrancy attack or an obvious dos attack or anything like this the vast majority of them are just you know logical errors that the developers made and I'll tell you for this prepared audit it is just that it's a logical error that the developers made that is it's not any type of vulnerability that I can just show you it applies to the code base and to the the code that that they were writing and and it just gets you to see that oh this is what real critical vulnerabilities or you know High vulnerabilities whatever you would rank it as looks like and then finally um if you want to write some test cases for this you can go ahead and do that uh one other thing I'll add is poc's when you do find a critical it's it's good to go through in P it we talk about that in the prepared audit introduction sort of write up that is there um fuzzing I would say do not worry about fuzzing for this prepared audit this is something that's intended for you to find manually and go through and and there's a few things that you could point out but yeah no fuzzing for this one we will get into fuzzing later so that's how I would go through and and attack the the prepared audit all right so that is the gtda method I hope going through that was very useful for you and I hope that you can actually go ahead and implement this in your own auditing approach and I hope that seeing the security researchers questions and my answers to those were helpful as well go ahead try out this method see if it works for you iterate on it make it work for you and then get back to me let me know in the comments below if this method is working for you or if it's something that you're going to try out and of course also if you're really interested in this security stuff if you want to become a senior Auditor in 6 months while avoiding as much of the trial and error as you possibly can that I have personally gone through then I went down and in the description below I put the six steps to be become a senior Auditor in 6 months that's basically just distilling down what I see as the six important things that you've got to do to get from where you are right now to to where you want to be as a senior auditor so if that's something that you're interested in you can go and you can grab that in the description if it's not then don't go in the description don't grab it that's totally fine if you're also interested in connecting with other people around the world who also happen to be interested in this blockchain web 3 security thing then you can feel free to go and apply to join our absolutely free community at lab. guardian audit.com and I hope to see you in there so with that out of the way I can't wait to see you next time