Reading Audit Reports Like an Auditor

medium

Learn with your AI

Pick a depth. Each prompt opens in your AI pre-loaded with the lesson. Click a row to preview the prompt.

Or teach me the whole lesson:

Why this matters

Audit reports from Trail of Bits, OpenZeppelin, Spearbit, Cantina, Code4rena are the highest-density technical writing in DeFi. Senior auditors read them not to find bugs the team missed, but to learn new bug classes and see how peers describe risk. The skill is in the cross-reading: same protocol, two reports, find what one auditor saw and the other didn't.

Demo

A typical report's anatomy: severity matrix (Critical/High/Medium/Low/Informational), per-finding sections (description, impact, recommendation, response), executive summary. The Critical findings are usually obvious in retrospect; reading WHY they were missed in pre-audit dev is the lesson.

Try it yourself

REPRODUCE — pick a recent Critical from Cantina or Code4rena's public reports. Compile the project, write a Foundry test that fails on the pre-fix code.
PATCH — apply the recommended fix. Re-run; test passes.
VERIFY — write your own variant invariant. Find one bug the auditor flagged that you'd describe differently.

Reading Audit Reports Like an Auditor

Why this matters

Demo

Try it yourself

References