The leaks · 46 / 86 · 2 min
Audits
An audit is a report by someone paid to read the code, usually for a short time. A logo that says audited is not a warranty.
A logo that says audited is not a warranty. Read the date and whether the code changed after.
A worked case
A protocol shows an audit badge. The audit excluded the upgrade mechanism, or the code changed the next month. A person deposits because of the badge. The bug was in the part the badge did not cover.
What it covers
A dated report, a named firm, a specific commit of the code. Findings can be fixed, ignored, or only partly fixed. Read the unresolved issues, not the badge.
What it does not prove
It does not prove the team will keep the admin key unused. It does not cover a later upgrade. It does not cover the economic design, the unlocks, or the founders' intentions.
A project that will not link the actual PDF is wearing the word.
The badge and the code that shipped next
An audit is a paid reading of some code, usually for a few weeks, by a firm whose logo you are then allowed to put on a website. It is not insurance. The DAO had reviews and still lost the ether, because reviews miss things and because the interesting bug was in the order of operations a reader can stare at and still not weight properly. Later protocols learned to show the badge and hide the scope: this commit, not the upgrade key, not the bridge, not the code we will deploy on Friday.
Read the date, the commit hash, and the list of issues they did not fix. If the address you are about to fund is a proxy, ask whether the audited code is the code it points at today. A logo cannot answer. The report can, if you open it.
When a project says audited as a complete sentence, they are hoping you will not ask for the rest of the sentence. The rest is: audited on this date, for this repository, with these exceptions.
Read it yourself
These links are the record. They are not a recommendation, and they are not instructions. A news story or a court paper can still be wrong about a detail. The check does not change because a famous name is in the story.
Apply the check
Open a question. The line is about this topic. It is not a verdict that anything is safe.
The auditor, who was paid for time. Not you, if it fails.
The team, if they can deploy different code after the report.
The bug that remained. The badge cannot reverse a transaction.
Check yourself
Does an audit mean the protocol cannot lose money?
No. It is a limited review of code at one moment.
After this you can open the report and see what was left unfixed, or treat the badge as decoration.