Smart-Contract Security 201: Auditing Lessons for Solana Founders
summary
Recommendation: run multiple audits (aim for 2–5 audits and re-audit every release), add automated layers before manual review, and treat post-deploy monitors as essential. Use Anchor for compile-time checks, x-ray and V rust for static scanning, telik to write Rust tests instead of TypeScript, and a Watchtower-style monitor for runtime. Expect scanners to return dozens of hits (often 25–50 false positives), training to turn a dev into an auditor takes about 6–9 months, and economic-model checks prevent Mango-style manipulation.
AI-written summary · about
chapters (7)
- 0:00Introductions
- 1:47Importance of audits
- 5:16Automated tooling limitations
- 10:11Holistic security approaches
- 15:48Lessons from mango markets
- 20:23Preventing bad actors
- 24:31Becoming an auditor
related talks
15mWhy Smart Contract Audit is Not Enough
31mNeed of Web 3.0 Security
44mWhat your auditor REALLY thinks but is afraid to tell you...
58mEnd-to-End Smart Contract Audit
13mScaling Smart Contract Security with AI
01h 02mDiscussion - Auditors, Sessions 3 & 4
11mOpen Source X-Ray: Solana Smart Contract Static Analysis
18mFireside Chat with Dyma Budorin