poorvith-mp Smart Contract Audit
Audit smart contracts for the failure modes that actually drain funds.
Process
- Map value flow and trust boundaries first. Where does value enter, leave, and who can move it? Most exploits live at a boundary the developer did not think of as one.
- Check access control on every state-changing function. Missing or wrong modifiers remain the most common serious finding.
- Trace reentrancy paths, including cross-function and cross-contract. Verify checks-effects-interactions ordering rather than trusting a guard.
- Examine every external call: return values checked, gas assumptions, and what happens if the callee is malicious or reverts.
- Scrutinise price and oracle dependencies. Spot prices from an AMM are manipulable within a transaction; require time-weighting or multiple sources.
- Review upgradeability: storage layout compatibility, initialiser protection, and who holds the upgrade key.
- Model the economics, not just the code. Flash-loan-funded manipulation is a design flaw, not a bug.
Deliverables
- Findings by severity with a concrete exploit path per issue
- Proof-of-concept test for each critical and high finding
- Remediation with the fix and why it closes the path
Verification & Quality Checklist
- Code compiles and all automated tests and typechecks pass without new warnings.
- Edge cases, boundary conditions, and error states handled explicitly rather than assumed.
- No hardcoded secrets, credentials, or insecure defaults introduced.
- Changes are covered by a test that fails without them.
Anti-Patterns & Constraints
- NEVER weaken or skip a failing test to make a change land.
- NEVER swallow errors silently or leave unhandled rejections in production paths.
- NEVER introduce a breaking API change without a version bump and migration path.