What makes us different?
For Web3 to scale, founders must take security seriously. AuditOne developed its strategy for securing smart contracts based on traditional audit firms and bug bounty platforms.
Traditional audits: 1-2 anonymous auditors examine a project's codebase and document the bugs in a report. This method has served its purpose, but traditional firms that adhere to this have long waiting times and high prices for audits. Projects cannot obtain the services they need when they want them, and auditors earn a fraction of the firms' fees per audit.
Bug Bounty: A group of random security experts examines the code in bug-bounty competitions, highlighting any findings and receiving rewards. However, no report is issued, raising doubts about the consistency of the audit since auditors lack incentives to guarantee the entire code's security. Furthermore, there is no guarantee that the best people will work on the bounty.
Trust Layer integration for Platforms: Our primary purpose is to build trust and ensure that people are not scammed or affected by smart contract hacks. We are integrating verifications on different dimensions, namely on token, user and space level. We offer security audits, due diligence, tokenomics reviews, NFT collection reviews, KYC and social profile reviews. Successful verifications will build more trust in the communities and help platforms onboard only quality projects/partners.
AuditOne
AuditOne combined both approaches of the bug bounty and the traditional auditing firm with four auditors and an independent reviewer. The highest-ranking auditor is picked as the lead, and auditors working independently to audit a project decrease the probability of collusion while increasing the likelihood of identifying problems others may have missed throughout the audit. While also incentivizing them to compete to identify issues on all levels with a bug bounty. The project team and AuditOne auditors meet to discuss the issues found and fix them before we can issue the final report.
Our process separates us from other audit firms:
Like other smart contract firms, rubberstamping a project with a complete audit isn’t our goal. We want to make the auditing process as transparent as possible. While providing the projects with the best auditing strategy to reduce the risk of bugs falling through our net.
Unlike audit firms, most projects' fees are distributed to the auditors, ensuring they receive sufficient compensation for their work.
Traditional audit firms usually have one or two auditors examining the code over a period. At AuditOne, we created a pool of four independent auditors. Our process has more auditors examining the code, and we also add a bug bounty element during the session. Rewards are given to auditors based on the severity of the issues they discover.
If less severe issues are identified, projects pay less. However, if severe issues are found, the projects reward the auditors, incentivizing them to comb through the codebase thoroughly.
To ensure the highest quality of work is extracted from the auditors, we have an independent peer review of the audit once it is complete to verify the auditor's findings. After the codebase is fixed, we review the project to ensure no bugs are inserted into the fix before issuing the final report.
We perform KYC on our auditors so projects can feel confident in the people performing their audits. We don’t hide our auditors, who are our organization's centerpiece. You can view our auditors on our leaderboard here.
During the audit, a lead auditor (senior expert) will be in charge of the team; they will aggregate the final report before it is reviewed. Projects can be confident that at least one senior expert will be involved in the process. However, this does not mean that the other auditors are not senior. One is just picked to lead the team during this phase.
Additionally, we vet all our auditors with a verification examination and a technical interview to ensure they understand what is expected. Vetted auditors ensure that highly skilled individuals will always be reviewing your codebase.
Because we have a large pool of auditors to pull from over 150 and counting, this reduces the waiting time for an audit. Unlike traditional firms with long waiting times, some can take months before the audits start.
Last updated