Audit report template

Since we are on the topic, here is a template you're free to use for audit reports.

It's a little opinionated in some ways. You can certainly just use only part of it or none at all...

The title should describe the contract or contract system this report pertains to followed by some standard service name (i.e. "Contract Security Audit").

Examples:

Favvom Contract Security Audit
Favvom Multisig Contract Security Audit
SRQj Contract Security Audit

It's recommended that your overall title use capitalization like a book title but then your later headings "Do capitalization like this".

Your report might then continue into the following...

Table of contents

• Introduction
  • Disclaimer
  • Document structure
  • Overview
• Audit summary
  • Per-contract vulnerability summary
• Summary of findings
• Detailed findings
  • Example finding 1
  • Example finding 2
  • Example finding n
• Appendix A: Test suite
• Appendix B: Finding rating classification

Introduction

Ethereum Security Blog was retained by Acme Corp to perform a security audit on their Acmechain contract...

Disclaimer

Ethereum Security Blog makes every effort but is in no way responsible for...

Document structure

The first section contains an overview of the contract functionality contained in the scope of this security audit...

Overview

The Acmechain serves multiple purposes...

Audit summary

This security audit was conducted on the version of Acmechain contained within the Git commit of hash 8a7b840. This included the file Acmechain.sol which instantiates one contract (Acmechain) and one library (Acmemath).

Per-contract vulnerability summary

Acmemath (Acmechain.sol)

No findings to report.

Acmechain (Acmechain.sol)

2 must fix findings, 1 informational finding.

Summary of findings

Detailed findings

Example finding 1

Classification: Must fix

Asset: AcmeChain.sol

Description

Lorem ipsum blah blah blah.

Recommendations

Lorem ipsum blah blah blah.

Example finding 2

Classification: Must fix

Asset: AcmeChain.sol

Description

Lorem ipsum blah blah blah.

Recommendations

Lorem ipsum blah blah blah.

Example finding n

Classification: Informational

Asset: AcmeChain.sol

Description

Lorem ipsum blah blah blah.

Recommendations

Lorem ipsum blah blah blah.

Appendix A: Test cases

(Ideally work out something here with test cases, hopefully automated ones, as a value-add to the customer)

Appendix B: Finding rating classification

Some pop-up firms doing smart contract audits have chosen to take an "OWASP-like" approach to this. See the table below.

They also tend to call this "vulnerability severity classification" instead of the more generalized "finding rating classification".

The writers of this course believe smart contracts, especially those out in public on the Ethereum blockchain, are a different animal. They don't warrant the same rating scale as traditional web apps. It's better to chunk findings into the following:

• Must fix
• Consider fixing
• Informational

And to say "findings" over "vulnerabilities" because then you get the berth for informational stuff. Like, hey we couldn't help but notice you could save some gas doing fill-in-the-blank.

Overall this appendix B might just contain the table below.