What I Learnt From My First Smart Contract Audit

I'm learning smart contract security through Cyfrin Updraft's Security course. This was audit #1: a small Solidity contract called PasswordStore. The full write-up, my notes, and every @AUDIT comment live in my security repo. Nothing sanitised.

---

What even is a smart contract audit?

It's a security review of a codebase. Experts read the code, test it, and report what could go wrong. Crucially it is not a guarantee: it reduces risk, it doesn't eliminate it. I learnt that in Section 2, and it reframed everything that came after.

---

Getting started: onboarding a real client

Before reading a single line, you onboard. You ask for the repo, the scope, the commit hash, build/test commands, and basic contract metrics.

The commit hash is the important one: it fixes exactly what's in scope. Anything the team commits after it is unaudited.

My first real lesson came here. The README inside my checkout listed one hash, but the client's latest README listed a newer one, because the README itself had been updated in a later commit. The copy sitting inside your own checkout can be outdated. Always confirm the scope hash against the client's latest README, not the one you're staring at.

---

The tools

Two stages, and one detour.

Sizing. I ran cloc and the Solidity Metrics VSCode extension to measure the contract before reading it: 20 nSLoc, complexity 10. That drives how long a review takes and what you charge for it.

Reporting. The client's README suggested pandoc + LaTeX with the eisvogel template. I installed pandoc and converted the logo, then found out the full LaTeX stack is roughly 5GB and fiddly for a first attempt. I switched to an HTML-friendly template using claude instead and shipped the same report at a fraction of the setup cost.

Lesson: perfect tooling is worthless if it stops you from finishing.

---

What I found

Findings get severity ratings:

• High: breaks the protocol completely, risks user funds, likely to happen
• Medium: partially breaks it, may impact funds
• Low: doesn't break it, but still needs fixing
• Informational: a note, not a vulnerability

⚠️ Spoiler warning: PasswordStore is a Cyfrin course exercise. If you're working through it yourself, skip ahead to Shipping it.

The headline finding was that the contract pretends to be private:

// @notice This function allows only the owner to set a new password.
function setPassword(string memory newPassword) external {
    s_password = newPassword;
    emit SetNetPassword();
}

The comment says "only the owner". There is no owner check. Anyone can overwrite the password.

The second High: even with access control fixed, the password is stored in plaintext on-chain. On-chain state is public. I proved it by reading the storage slot directly and decoding it back into myPassword.

Final tally: H-1, H-2 (High) and I-1, I-2 (Informational).

---

Shipping it

A finding report is the deliverable, not your notes. My private audit_notes.md never left my machine. The client got a structured report written against a fixed template.

📄 Read the final audit report (PDF)

---

What I'd do differently

1. Verify the scope hash against the client's latest README first, not the copy inside my checkout.
2. Check dependencies before anything else. The client repo shipped with empty submodules, so nothing built until I ran git submodule update --init --recursive.
3. Not fight the tooling. Five minutes into LaTeX pain I should have switched, not an hour.
4. Keep tagging findings as I go. The @AUDIT comments meant the report almost assembled itself.

---

Final thoughts

An audit isn't about being clever. It's about being systematic: scope it, size it, read it, tag what's wrong, rate the severity, and ship something the client can actually act on.

Two High findings in a 20-line contract was a good reminder that small code is not safe code.

---

---

Drafted with DeepSeek Harness; all experiences, findings and opinions are my own.

About the Author

Assalamualaikum guys! 🙌 This is Mohammad Ayaan Siddiqui (♦moayaan.eth♦). I'm a Full Stack Blockchain Developer, Crypto Investor and MBA in Blockchain Management with 2 years of experience rocking the Web3 world! 🚀 I've worn many hats:

• Research Intern at a Hong Kong-based firm 🇭🇰
• Founding Engineer at a Netherlands-based firm 🇳🇱
• Full Stack Intern at a Singapore-based crypto hardware wallet firm 🇸🇬
• Blockchain Developer at a US-based Bitcoin DeFi project 🇺🇸
• PG Diploma in Blockchain Management from Cambridge International Qualifications (CIQ) 🇬🇧
• MBA in Blockchain Management from University of Studies Guglielmo Marconi, Italy 🇮🇹

Let's connect and build something epic! Find me at moayaan.com 🌐 or on X @moayaan1911