How to Become a Smart Contract Auditor

Transcript

Hi everyone. Uh, welcome for coming. Today I will be answering the question I get asked the most uh, in my DM um, maybe once a week, definitely more during bull markets. How to become a smart contract dtor. Quick intro. I'm Nisso. You can find me on nedo onx. Um at the end of the presentation there will be a QR code with all the resources and the links. So don't worry for now. I've joined web free security three years ago. Um before that I had absolutely no background in tech or in coding experience whatsoever.

And since then I founded solid editors the French speaking web free security community. So if you're a French French speaker, please um hit me up at the end of the talk and I will send you all the information if you want to join us. And I'm now a blockchain security engineer at 12 bits. So how do you actually become a smart contract editor and why you should you become a smart contract editor in the first place? Web security is frankly broken. Um more than 12 billion dollars have been stolen since May 2016. Um, every other week there is a new hack, often bigger than the previous one. And it's pretty hard to be honest. It's pretty hard today to

say to non-crypto people, let's say your family or your own friends, come to come to web three, put your money in a D5 protocol, you will earn great yield, you will have better decentralization, but there is a high chance you might lose it all. So we have improved a lot over the years but we still have um a long road ahead of us if we want one day for web free to be adopted by the general public. This make in my opinion our job very very interesting even more so than working web two security because in web security the main asset to be stolen is your data. So hackers will be focusing on stealing your credentials, your names, your emails, and they will then

have to resell them on the dark web in order to make some money. In web free, it's much more straightforward. It's like breaking the bank. Uh if you're a successful hacker in web three, you will end up with a wallet full of crypto money. And as we all know today, crypto money is almost like real money, even easier to launder. Um so it attracts a lot of very talented hackers from web two and from other horizons and on the other hand we are lacking um a talent pool of defenders so auditors and this is sorry in my opinion why um our work truly matters. As I was saying, the most successful hackers in web three

are not like teenagers in basement. They are nation state threat actors. Lazarus group from North Korea. You may have heard of them. And we can presumably think that most of the fund they are stealing from web free protocol and user are then used to finance criminal activities um research on weapons, buying things of the black market. um basically a lot of very bad thing we don't want them to have money to do. So by working in web security you are actively fighting the bad guys and you are truly contributing to the industry you are working in.

It's a job that is high in demand. Um as you can see the number of bug bounty program has been um constantly growing over the years and I truly believe we are very early and that this curve won't be stopping anytime soon. So if you truly become good at finding bugs and at helping clients build safer software, you will basically never be lacking any type of job opportunities. Especially if you're in this room, I guess you truly believe web three is the future. And in that case, if web three is meant to grow, the job of auditors is meant to be um more in demand that it's today.

And lastly, but not least, auditors are well known for being being paid very well um for two main reasons. The first one, as I said, we are a low supply in the high demand market. So, of course, this helps a lot. And the second one being um it can be a pretty stressful job to be honest because we are crucial um part of the client of the security life cycle of the client and the protocol we are working with. So messing up in one of our audit could mean letting a critical bug slip into a contract that will end up deployed and then hacked by hackers.

So it's a very hard job. It's a very demanding job. um you you have to give your 100% at every audit you are participating in and this is why the pay is good but also know that it can be a stressful job. Now that uh everything has been said I should also tell you that there's a catch. Um some people might believe that by trying to become smart contract editor this will be their life. Um, and this is definitely not how being a smart contract editor looks like to be honest. You won't be auditing from the beach on your laptop and you might not be diving into a pool of all the rewards you would have gained. Um, at least not

at the beginning. This is much likely more like what the reality will look like. Um, because the truth is it's a hard job and to become really good you have to work a lot and you will be uh you will have to read a lot of code. you will be probably locked in your room for long hours. So don't expect the beach anytime soon. So what do we really do as smart contract editors? Um I said it we find bugs but how exactly do we find bugs? The best way I found how to describe it is imagine you are tasked with securing um very complex system. Let's say a digital bank at the beginning at the start of an audit we are given the blueprint of that bank in the form of codebase. Um it's basically a lot of

files with thousands of line of code and our role as editors is to um read every single line of code and every single file and understand how the system works deeply in order to find its weaknesses and in order to understand how to exploit them. So this is what we are given at the beginning of an audit. But this is really what we are facing because every single system we are working with is really complex at the beginning and it looks like a giant puzzle with many many puzzle pieces and our job is to assemble them together.

So this is what auditing really looks like to be honest for long hours locked in your room. Uh you will be thinking really hard ringing a lot of code and hopefully in the end you will end up with a clear mental model of the system you have to secure. And now the fun begins because you will be able to um imagine all the attack vectors that an attacker could try on the system and you will have to try them out yourself either to find out that it's a false positive and it's good meaning that the credit is secure and the system also otherwise you may have found a way for an attacker to break into the bank and steal the precious fund of the user and in that case your role is to work with

the client to patch the vulnerability and to make sure the system is now secure. But this is also an important part of the job. We are not only report raisers. We have to advise, help and educate our clients because the ultimate goal is to raise the security bar of the entire space. And so by helping our client not make the same mistake they were making in the past, we are basically helping the entire space. We are also well equipped. Um we have quite some tools to be using static analysis fuzzing for more verification basically cutting edge technologies um to ensure that no bugs are left unfound and um no uh edge cases are left

uncovered and this is also why at trail of bits we are working so hard on open source tooling because we truly think open source help the entire space. So if you're a developer you should be using them. This will definitely help you before going into your next audit. And if you're an auditor, you should also definitely use them. Otherwise, you are missing out. So now, now that you're convinced that this is the job you want to do for the rest of your life, how do you actually become a smart contract editor? I broke down the path into four four simple step. Uh but simple doesn't mean easy and the path can be pretty long to be honest. Um the first step will be to learn

programming and computer science with the assumption that you are not already a developer. Of course um learning the basics is really important at the beginning to help you understand what's going on under the hood. So you won't be as good as the developer you are working with. But if you truly want later on to become a well-rounded security professional, you will definitely have to master these two topics. So you should start as early as possible. And my recommendation would be Avat, which is an amazing free online course. Step two, learn blockchain specifics and technologies. My recommendation would be EVM and SD because they are the two most beginner friendly with the most resources and the most job

opportunities. You will have plenty of opportunities later on to diversify into other technologies and other niches, but at the beginning, these two should be the easiest. And if I were you, I would go crazy on updraft and RA skills. Both very great resources and free. Step three, learn web three security. You've learned how to build. You will now learn how to break and you will have to understand what it means to adopt the attacker mindset and you will have to train that attacker mindset which is pretty different from building software.

to do that. CTF are in my opinion the best way to um try out at the beginning but you should not fall into the trap of doing only CTF for months because CTF are really fun uh they can be addictive I know what I'm talking about so do only a few of them and quickly uh or in parallel you should be learning from past audit reports uh because especially at the beginning you might not even know what a bug looks like what a vulnerability is what type of weaknesses you should be looking for in such and such protocol so by building your knowledge base by reading from past studies report from top editors. You will definitely be uh this will be very helpful in your first audit and throughout your career.

Step four, practice, practice, practice basically until you master your craft. There is no end to this one to be honest. But in web three we have an amazing learning opportunity which is called public audit contest. It's like a real contest where you are competing against other independent auditor. Um and for every um contest you will be able to study everything that you've missed at the end because the audit report will be made available. And this is an amazing learning opportunity because if you find bugs and valid bugs you can get paid for it and then you will be able to learn from all of your mistake and apply this into the next context and so on and so on. So basically at the beginning you will be missing every single bug you can

think of. That's okay. You will um fail miserably but you will learn from it very quickly and apply it. And this this create a very uh great feedback loop and throughout all this month uh all of your hard work will be recognized because this platform have public leaderboard. So hopefully you will be climbing the public and this will open up plenty of job opportunities after all because there is no um field that is as meritocratic as web free in my opinion and there is no best resume than showing off all the bugs you have you have found um to the potential client you want to work with and then what you've mastered all the three previous step I showed you um you

did great in contest you reached the top of leaderboard. Now, you should reach out to us because we are always looking for experienced smart contract auditors at Trade of Bits or basically smart people that can find great bugs and help our client build safer software. However, since I might be biased, don't worry, there are other um path forward and I'm pretty convinced that you will be able to find something that meets your needs and wants as the successful smart contract editor you become.

So web 3 is amazing. I guess if you're here, you truly believe in it too. But web 360 needs more improvement. So there is many many bugs to be found, many code, lots of code to be secure. Um if you think you have what it takes, I think you should try out. I'm pretty sure you won't regret it. Thanks. We got we have some time for Q&A. So yeah. Okay. If there is a few question four minutes. Okay.

I think we're good. Okay. Then we're good. All right. Nice. Thanks guys. [Applause] Awesome.