Introduction

Immutability vs. Governance

Smart contracts form the cornerstone of public blockchains like Ethereum, enabling the execution of software scripts without relying on third-party verification. This decentralized approach allows for the issuance of stablecoins, tokens, and various digital assets, supporting a range of applications such as automated borrowing, lending, exchanges, games, and social protocols.

Smart contract protocols may be deployed in an immutable and non-upgradeable manner, ensuring users’ confidence that no third party can tamper with the code to their detriment. However, this inflexibility poses a challenge when addressing potential security vulnerabilities. As software is inherently prone to bugs, occasional updates or changes to the code become necessary to safeguard user assets, especially for those who may not be aware of subsequent vulnerabilities.

To tackle this issue, some smart contract arrangements opt for governance mechanisms, which introduce a new consideration for maintaining decentralization effectively. These governance structures, when established securely and reliably, can effectively address security concerns while upholding the essence of decentralization in smart contract ecosystems.

Key features of governance mechanisms

Without secure and reliable governance structures, users may question the trustworthiness of these applications, hindering adoption and undermining the fundamental principles they are built upon. A robust governance framework is crucial for instilling confidence and ensuring that the decision-making processes within these apps are transparent, inclusive, and accountable.

A reliable governance structure encompasses two key aspects: reliable technology and the dependable execution of governance outcomes.

Firstly, the underlying technology supporting applications on Ethereum must be secure, resilient, and capable of handling decentralized decision-making processes. This includes secure smart contracts, consensus mechanisms, and decentralized protocols that enable transparent and tamper-proof governance.

Equally important is the execution of governance outcomes. For a decentralized governance structure to be trusted, it must demonstrate reliability in translating decisions into action. This involves effective communication, transparent voting mechanisms, and efficient implementation of changes based on community consensus.

Challenges and case studies

In this article, we will delve into some recent cases of governance mechanisms that faced challenges, explore their underlying causes, analyze the consequences, and propose potential preventive measures. By doing so, we hope to further support the growth of these trailblazing projects as they navigate the mostly uncharted waters of governance in the realm of smart contracts.

The Metamorphic Attack on Tornado Cash Governance

Course of Events

Tornado Cash is a decentralized protocol on the Ethereum blockchain designed to enhance transaction privacy. Due to being listed on the Office of Foreign Assets Control (OFAC) sanctions list, Tornado Cash has encountered challenges with user adoption and engagement in its governance processes. Subsequently it was subject to a governance attack.

According to the post-mortem by OpenZeppelin, a well-renowned smart contract security firm, and the twitter thread by Samczsun, a well-recognized security researcher who analyzed the incident, the course of events happened as follows:

On 20th May, the attacker submitted a proposal including a backdoor masked as an emergency stop to the Tornado Cash DAO. This proposal claimed to be similar to a previous one, yet contained a slight change, allowing the attacker to manipulate it after the voting.

After the DAO members approved the proposal, the attacker used the SELFDESTRUCT function to invalidate it. Then he used the CREATE2 function to replace the deleted proposal with a new one containing malicious code.

As it used the same address as the previous proposal, which had been accepted, this new proposal did not require a vote.

The malicious code granted the attacker 1.2 million fake votes, effectively yielding him full control over the DAO as the remaining (legitimate) voting power only amounted to 0.7 million votes.

It is important to note that this does not affect the functionality of TornadoCash but just the governance.

Consequences

To be able to vote, TORN holders have to lock their tokens. Vice versa, if they do not want to participate in further votings, they can unlock their tokens again, losing their voting power. This effectively makes votes ‘vouchers’ that can be redeemed for TORN tokens.

Having full control over the DAO, the attacker went on to redeem his fake votes for real TORN tokens. Over the following two days, the attacker withdrew 473,000 TORN tokens in total and sold them for profits. The massive selling pressure created by the attacker selling so many TORN tokens caused the market price of TORN tokens to drop by 40%.

Subsequently DAO members were encouraged to unlock and withdraw their TORN tokens to prevent the attacker from redeeming even more fake votes for tokens.

Ironically, the attacker deposited some of his profits into TornadoCash to launder them and obfuscate his path.

On 21st May, one day after the attack, the attacker submitted another proposal, ”offering” to reverse the attack by destroying his fake votes (see proposal). This again is quite ironic as he holds the absolute majority of votes, however, it led to relaxation among DAO members and an increase of the TORN token by 10%. Yet, while this reversal would reinstate the governance infrastructure of TornadoCash, it will not bring back the funds lost. Finally, DAO members have already announced plans to fully rebuild the governance infrastructure to prevent similar exploits in the future.

Prevention

The main lesson to be taken away from this attack is that allowing smart contracts to self-destruct can have rather dangerous consequences. When creating or assessing a smart contract, there are several aspects to be looked out for:

• As highlighted by samczsun, one should verify that a contract cannot self-destruct if one is depending on the verified source code to stay the same.
• Verify how a proposal contract has been deployed. If it was deployed by a destructible contract or is using the metamorphic contract pattern, do not interact with it.
• The opcode SELFDESTRUCT will be limited with the Cancun upgrade, yet there will still be existing smart contracts that use it. Vitalik Buterin wrote a blogpost on how to deal with these instances.

The re-centralisation of Aragon DAO

Course of Events

First off, it is important to understand the relationship between Aragon DAO and Aragon Association: Aragon DAO was founded by the Aragon Association, a DAO tooling provider, to slowly take over the decision making power as well as the funds to decentralize the organization. Plans were to move all funds of the Aragon Association into the Aragon DAO to give them into the hands of the community.

However, this was not yet fully achieved. According to the Aragon Association, it all started when Aragon DAO received 300,000 USDC from the Aragon Association as a ‘test run’. Combined with public announcements to soon pass further funds on to the DAO, this called up a group of actors which saw a chance to profit from the vulnerable governance infrastructure of Aragon DAO.

This group made use of the fact that ANT tokens (which can be wrapped into wANT tokens, the DAO’s governance token) traded at a large discount to the treasury value, aiming to gain a majority of votes (wANT tokens) which would enable them to dissolve the DAO and redistribute the treasury funds to wANT token holders. As a consequence, they stacked ANT tokens over the time span of a few months to be able to dominate upcoming DAO votings.

Consequences

Aragon Association spotted this coordinated buying activity and as it opposed their plans for the DAO, they decided to rededicate the DAO’s funds. In a press release, they labeled this coordinated activity as a 51%-attack and stated that this would yet be another example showcasing that “no project can rush towards the ideals of decentralization at the expense of security”.

However, this move was debated heavily in the web3 space. While some commentators saw the motivation behind their attempt to save treasury funds from simply being paid out to token holders and deemed it reasonable, Aragon Association was strongly criticized for their decision making process. After all, it is questionable whether re-centralisation or just a lack of centralisation is even that big of a problem for these kinds of DAOs, in this case the source of conflict was mainly the discrepancy between expectations and reality concerning the level of decentralisation.

Prevention

There were only a few ways to resolve the situation after the coordinated buying activity was spotted. But there may have been other ways to prevent this situation at the time of deploying the DAO.

Options to prevent the “attack” would have been:

• Keeping dry powder for potential buybacks to prevent hostile takeovers (not necessarily aligned with the vision of decentralization, but effective).
• Building monitoring systems like they are established in traditional economies, which would give automated notifications if certain addresses pile up a significant amount of tokens/votes (could also be coupled with a disclosure system).
• Adding special rules for spending treasury funds to the DAO’s governance systems. For example, spending could be limited by combined time and quantity restrictions. In this case,spending more than 5% of the DAO’s treasury value per week would require a 75% approval instead of a standard 50% approval.

On the other hand, one could argue that the Aragon Association should not have deployed more money than the amount of money that was necessary to purchase a majority of all available votes at that time, thereby not providing any financial incentive for hostile takeovers.

However, in a regular market, the value of the shares/votes in a DAO should be equal to the value of the treasury (as dissolving the DAO would distribute the treasury funds proportionally to all token holders) plus either a premium or a discount related to expected future performance of the DAO. Following this assumption, hostile takeovers would only be profitable if the DAO would underperform revenue expectations, which leads to the final question of whether a value-eliminating DAO should even exist in the long term (excluding DAOs focused at public goods).

Off to a bad start: The failed retrospective funding proposal in Arbitrum DAO

Course of Events

Let’s examine a recent event that sparked discussions within the Arbitrum Foundation, highlighting the challenges of decentralization. It all started with the Arbitrum airdrop, which provided the Arbitrum DAO with substantial funds in its treasury.

With this in mind, Lemma Ltd., a company associated with the Arbitrum Foundation, posted the first proposal into the DAO (AIP-1). The proposal, specifically the section titled “Special Grants,” triggered significant discussions. It proposed the creation of an “Administrative Budget Wallet,” granting the Arbitrum Foundation exclusive access. The wallet’s purpose was to cover ongoing administrative and operational costs while making Special Grants, involving a total of 750 million $ARB tokens (approximately 1 billion USD in value at the time of the proposal).

Consequences

Commentators raised concerns about this proposal for two main reasons. Firstly, it could have enabled the Arbitrum Foundation to provide grants without on-chain ratification. Additionally, Blockworks Research discovered that the 750 million $ARB had already been transferred to the Arbitrum Foundation prior to the vote, creating a perception of sidestepping community approval.

The situation sparked heated debates with some members of the community feeling that the proposal lacked transparency and appeared more as a retrospective and non-binding request for approval. Furthermore, the previous sale of 10 million $ARB for stablecoins made it impossible to fully reverse the actions taken.

Ultimately, the proposal was declined, with more than 75% of votes against it. The community expressed its concerns, urging the Arbitrum Foundation to address the situation and consider community feedback in a tweet, but some members remained unsatisfied.

Since then, some subsections have been successfully ratified, but the matter of funding the “Administrative Budget Wallet” remains unresolved. The incident has led to discussions about the perceived reliability of on-chain governance within the community.

Prevention

Several best practices could have helped avoid such situations in the future:

• Clear communication of all relevant details is vital, regardless of the proposal’s content. In this case, the omission of information about the fund transfer without approval fueled community discontent and influenced the overall disapproval of the proposal.
• Separate voting on independent topics within a proposal is crucial. Although some parts of the proposal, like the “Security Council,” gained approval, other contentious aspects led to its rejection. Separate votes for different components could have prevented delays in operations.
• Engaging in early discussions before the voting period is essential for complex proposals like AIP-1. Allowing ample time for discussions to take place enables responsible communities to make informed decisions and avoids a lack of clarity that may lead to disapproval.

In hindsight, the situation in the Arbitrum DAO serves as a valuable learning experience for fostering more effective and inclusive decentralized governance.

Summary

Doing community governance is anything but easy. However, there are three types of risks that can be identified. First, the risk of vulnerable smart contract code, secondly, the risk of a governance attack through misaligned incentives, and lastly, the risk of inadequate communication.

For each of these risks, we have provided a recent example as well as potential mitigation measures. While for the last two examples, the main focus for prevention should be on proper planning and communication, the first example shows the importance of smart contract code security. As a consequence, not just companies, but also DAOs should get their smart contracts audited by experienced security experts like brainbot.

To close, we hope that the ecosystem of DAOs will learn from these mistakes and that the reliability of decentralized governance will improve over time. After all, the space is still very young and immature and thus demands patience and support.

The Rise of Rollups

The avenue of rollups, revolutionizing blockchain interactions by making them faster and more cost-effective, has laid a solid foundation for enhancing user experiences in web3 while scaling Ethereum at the architectural level. The rollup ecosystem has experienced an unprecedented boom, surpassing any previous scaling solutions. The rapid growth witnessed over the past few years serves as a testament to our progress. With the first rollup going live in 2020, we now have over 20 operational rollups across optimistic, zk, and potential hybrid variants, with the number still on the rise.

However, the remarkable growth of the rollup ecosystem has naturally resulted in fragmentation, where rollups have emerged as isolated islands with minimal connections to one another. This is where bridges, like Beamer Bridge, Connext, and Celer come into play. Whether native bridges, cross-chain bridges, or multichain bridges, they offer a myriad of options to users, but can also lead to confusion.

The Challenge of Choice

Which rollup should one use? Which bridge is most suitable? What are the differences between them anyway? It all seems too complex.

The average user does not want to delve into the intricate details of the technological fabric that powers their desired outcomes. They simply seek the most convenient path to their goals. Convenience reigns supreme, as repeatedly demonstrated by the success of centralized protocols.

A convenient and smooth user experience encompasses various dimensions beyond what we commonly perceive through the web3 infrastructure. With that in mind, let’s zoom out and explore some of the crucial elements that contribute to seamless dApp usage.

The Building Blocks of Convenient dApp Usage

While the infrastructure of web2 is battle-tested and mostly fully abstracted from users, in web3 it is not yet the case. Web3 apps are still niche compared to the global applications market. This becomes clear when comparing web2 vs web3 app usage and how web2 apps are so well integrated in our day-to-day lives.

Web3 apps on the other hand, appeal to the most proactive and interested chunk of users out there. Although web3 infrastructure is still a work in progress, easing the UX needs to happen on several fronts at the same time.

Building Safe and Stable Products

Undoubtedly, a great user experience hinges on a remarkable product that delivers high value to its users. The finest products outshine their competitors by offering more features and surpassing them in terms of price, delivery, quality, and benefits.

Web3 products that offer a seamless user experience typically adhere to a simple design or centralization, granting total control over the protocol’s structure, operations, and performance. The best examples are centralized exchanges like Coinbase or Binance.

However, attaining equally outstanding products in a decentralized fashion is considerably more challenging. It necessitates the involvement of participants from various fronts, dispersing power, control, and likely even the assurance of a well-functioning system. This distributed nature of decentralized products poses unique hurdles.

As we move towards the standardization of the space and with the development of the current technologies like Zero-Knowledge proofs, AI, and among others, we will likely see automation happening. This automation has the potential to reduce manual input and potentially eliminate the need for certain third-party protocols that are currently required to ensure the functionality of web3 products.

As a result, we can expect an elevated level of stability and safety in the ecosystem.

Abstracting Away Complexity

The key to retaining users lies in delivering that “Aha” moment — the realization of value — as quickly as possible. Therefore, the user journey, from initial interaction to achieving the desired outcome, should be as concise as can be.

To achieve this, we need to optimize user journeys and eliminate any unnecessary steps that do not directly contribute to reaching the desired outcome. Currently, the process of using the same dApp on a different chain can involve an overwhelming number of steps and signatures, deterring users who fear making mistakes or find the overall cost (including time, effort, and stress) too high to justify the benefits.

This is where interoperability emerges as a significant factor.

Arbitrary messaging bridges (AMBs) such as Hyperlane, Axelar, Layer Zero, and potentially Beamer Bridge in the future, are laying the groundwork for reconnecting the fragmented L1 and L2 space and enabling communication between chains at the infrastructure level. By bridging the gaps between different chains that exist as separate entities, we take a step towards shortening the user experience. However, it still requires users to interact at the infrastructure level instead of staying within the dApp environment.

The next stride in reducing the user journey is account abstraction.

Imagine a world where you no longer need to worry about seed phrases, network switches, double-checking wallet addresses, or signing at every step of the process. Such a scenario would eliminate the need for users to interact with the underlying infrastructure, enabling the “Aha” moment to occur much faster. We already witnessed emerging use cases of account abstraction, as seen in the Argent wallet, for instance.

Looking ahead, we can envision a future where all bridges are automatically integrated into aggregators, which would be seamlessly prompted by dApps in the background. This automation would enable users to access the fastest, cheapest, and safest options to achieve their desired outcomes.

Accessibility and Streamlined Onboarding

In addition to revolutionizing architecture and automation, we must also focus on streamlining onboarding processes and enhancing accessibility in the web3 space.

Currently, one of the reasons why web3 remains a niche is the requirement for users to possess a certain level of technical literacy, especially when dealing with decentralized protocols.

Understanding the risks associated with web3 interactions necessitates familiarity with new terminologies that might be unfamiliar to normies. In today’s reality, if users fail to grasp the underlying concepts and mechanisms of a protocol, they are more likely to be unaware of the potential risks. Since users bear the responsibility for their actions, this lack of understanding becomes a significant deterrent to engaging with the web3 space.

To overcome this barrier to entry, we must meet users halfway by empowering them to take responsibility for secure protocol usage. This involves both protecting users as much as possible and encouraging them to educate themselves while minimizing the learning curve required to enjoy web3 products. Streamlined and assisted onboarding processes, as well as industry standards across different dApps and ecosystems, can greatly facilitate this process.

Moreover, why not introduce AI assistants to guide users through the dApp experience and provide them with the necessary knowledge before diving into the protocol?

Over time, these efforts will lead to the development of new habits. Ideally, existing user behaviors from web2 can be seamlessly duplicated into the web3 realm. This shift is crucial for achieving sustained and growing adoption, as it allows users to embrace the benefits of web3 without feeling overwhelmed or burdened by complex technicalities.

Direct User Feedback and Cultivating Community

One remarkable aspect of web3 is its vibrant communities and the availability of direct user feedback. These complex, decentralized systems are often open-source and transparent, allowing knowledgeable and technically literate individuals to contribute and shape the products they use.

There has never been a better opportunity to be so closely connected to users, consumers, investors etc. Therefore, it has never been easier to gather direct feedback and opinions about web3 products allowing us to continuously uncover further areas of improvement and enhance the product experience.

With the emergence of web3 tooling, marketers, growth leaders and product managers will have a better understanding and a more accurate understanding of the big picture. Bridging web2 and web3 data is essential to understand the entire journey of users across the funnel and interacting with them seamlessly across platforms.

Not There Yet, but Heading Towards It at High-Speed

The progress in the web3 space is awe-inspiring, with various advancements occurring simultaneously. As we move forward, the integration of AI is poised to accelerate this evolution. With more countries embracing cryptocurrencies and the emergence of CBDCs, blockchain technology is becoming an integral part of people’s lives. The existence of centralized systems may actually contribute to achieving the end goal of decentralization. They may serve as a temporary step to trigger widespread adoption until decentralized systems are just as performant and easy to use. At best, we can learn from web2 and from centralized systems to replicate such easy and straightforward user experiences as best as we can.

About

This article was written by Dina Bécane-Gonçalves, Growth Marketing Lead at brainbot, a venture builder and service provider located in Germany. As the Marketing Lead of Beamer Bridge, one of the ventures at brainbot, she conducts research on the current and future developments in the bridge space. You can find more articles written by her on her personal blog.

Beamer Bridge is an optimistic intra-chain bridge, allowing for frictionless transfers between Ethereum and various second layer solutions like Optimism, Arbitrum and others. It offers the fastest transfers and has the most secure setup of all bridges from and to Ethereum L1. Beamer Bridge will be a key tool for abstracting away complexity and improving user experience.

Smart contract audits are crucial to ensure a safe experience for users of decentralized applications. Decentralized audits can help do the trick. We’ll provide you with an overview of the concept and the ecosystem of decentralized audits and resources to become a successful auditor yourself.

In the fast-evolving landscape of web3, security is of high importance. Recent high-profile exploits have demonstrated the critical need for secure smart contracts and applications.

The success of decentralized applications overall is ultimately relying on a safe yet intuitive user experience. Thus, we believe that all actors in the ecosystem should contribute towards a higher level of security as a collaborative effort. To work towards this goal, each actor may use their specific expertise and experience as best as they can. Currently, project teams, white hat hackers and auditing firms like brainbot are already working on this mission. However, there is another way to support — even if you fit neither of these groups — and that is the one of decentralized audits.

In our recent article on decentralized audits (also called competitive audits), we analyzed how the increased demand for smart contract audits led to the emergence of decentralized platforms, which offer audits in the form of contests among skilled developers.

In this article we explain the concept of decentralized audits, demonstrate their appeal to developers and provide resources to enable developers to participate in decentralized audits.

The concept

In a previous article, we already provided an overview of the concept of decentralized smart contract audits, its characteristics and how it will impact the future of web3 security.

Decentralized audits emerged in early 2021 and are based on permissionless platforms that enable developer teams to reward others to review their code. Audits are conducted in contest format with findings submitted in tickets. After the deadline, senior members of the platform evaluate the findings, and auditors are rewarded for their contributions with a payout.

The approach leverages swarm intelligence to enhance the security of decentralized applications without requiring contributors to work for a dedicated smart contract audit firm. The key aspect of decentralized audit platforms is that they are completely open, allowing anyone to register as an auditor.

The appeal

Decentralized audits offer several advantages for developers looking to get involved in web3 security. First and foremost, decentralized audits offer complete freedom and flexibility. Developers can work on audits in their free time and choose which audits they want to participate in. They are not tied to a specific company or boss and can work independently. This makes decentralized audits an excellent option for digital nomads or those looking to work on their own terms.

Another significant advantage of decentralized audits is the potential to earn more income. As the demand for audits increases, audit platforms will take larger shares of the market, providing developers with opportunities to earn additional income by participating in audits. This can be a significant source of income for developers who may not have access to traditional audit jobs.

At this point, it is important to note that one does not have to give up their full-time position to become an independent auditor. Many developers also participate in decentralized audits in their free time, next to their regular jobs. The opposite also exists: At brainbot, we let our security researchers participate in decentralized audits in their work time to gain more experience.

Decentralized audits also have low technical requirements. All that is required to participate in an audit is a laptop and a Wi-Fi connection. Developers do not need to have any specific technical skills or certifications, making it an accessible option for anyone looking to get involved.

However, it is important to note that decentralized audits come with some disadvantages, including no stable income (investing time in contests has to be done upfront) and no insurance. As a result, it is crucial for developers to weigh the benefits and drawbacks before getting involved in decentralized audits.

The platforms

Apart from decentralized smart contract audit platforms, there are further platforms through which one can contribute to web3 security, yet those will not be in scope of this article. If you are interested in learning more about them, you can have a look at our previous article.

Code4rena

Undoubtedly, the leading platform in the realm of decentralized audit platforms is Code4rena. They invented the concept In February 2021, the platform launched its first decentralized audit of Elastic DAO and quickly gained momentum. By April 2021, the platform had already gained significant traction, with over 100 active auditors. Since then, its user base has grown exponentially, with over 1,000 active auditors as of March 2023. Today, Code4rena is the most prominent platform for decentralized audits, with the ‘original’ concept. The platform allows companies to offer a reward pool, with anyone able to participate as an auditor. Auditors are evaluated based on their performance and can improve their standings on the leaderboard. Furthermore, Code4rena offers private audits, enabling select auditors to participate in audits for confidential projects or stealth startups.

Sherlock

Sherlock is the second largest platform in the decentralized audit space. Although it was launched as recently as August 2022, it has rapidly established itself as a prominent player in the field. Like Code4rena, Sherlock primarily adheres to the original concept of rewarding auditors for identifying vulnerabilities. However, their approach has a unique twist — they only compensate auditors for medium and high severity vulnerabilities. Additionally, Sherlock offers audited protocols the opportunity to obtain insurance, which adds an element of accountability to their auditing process. By having some “skin in the game”, Sherlock is incentivized to strive for the highest quality audits possible, thereby enhancing the overall security of the decentralized applications on their platform.

The job

General Process

The process is fairly similar for both platforms. Audits are carried out in a competition format, where all vulnerabilities are submitted as tickets that are kept private until the contest is concluded. These tickets detail the vulnerability, its potential impact, its severity rating, and possible mitigation strategies. Audit contests have a set duration, and once they end, all the tickets are gathered and evaluated. The evaluation process is done by experienced members of the platform and is sometimes aided by other contributors, especially when dealing with large audit scopes where the number of submitted findings can be several hundred.

Optimizing Payouts

To optimize the payout, several aspects should be considered. First, we have to look at the reward mechanisms, which are similar for Code4rena and Sherlock. Generally, the reward for a finding depends on the severity of the issue, the uniqueness (how many others submitted the same finding) and sometimes also the quality of the documentation of the submitted finding. This way, the payout for a medium severity finding which was only found by you can be much higher than the one for a high severity issue that many contestants spotted.

How easy it is to spot high severity issues varies a lot with the complexity and the scope of the audited code. Compared to medium severity findings, high severity vulnerabilities often result from the interplay of several smart contracts or hinge on economic/monetary considerations, which can only be detected through extensive analysis of the whole application. This requires a good understanding of the respective business case and a lot of time. Since these investments do not guarantee finding a high severity vulnerability, going for the long shot can bear the risk of wasting one’s time.

On the other hand, audit contests for applications with high degrees of complexity or large scopes often attract less auditors due to the previously described problem, decreasing competition. This consideration shows that finding an ideal strategy is difficult due to the many factors to be thought of.

Regardless of scope and complexity, however, one can identify the most profitable contests to compete in with a simple rule of thumb. As each contest has a predefined duration and reward pool, one can estimate the amount to be paid out per day. While this value is meaningless on its own, it can give hints as to which audit contests to focus on. This can also be adjusted by whether one is open to work on weekends or not. Some contests only last a few days and if they include a weekend, working only on weekdays can make the schedule rather tight. Of course, this calculation does not provide a profound estimate of potential income, however, payouts for the same findings will be higher if the reward pool is bigger.

Judging & Escalations

After each deadline, judging contests are opened. In these judging contests, senior members review all submitted findings, decide on whether they meet the criteria to be included for calculating the rewards and rate them with respect to their severity. This process can be aided by regular contestants, who can rate their own as well as other contestants’ submissions. For this work, rewards are paid, although they are significantly smaller than the rewards paid for the audit.

If contestants disagree with the judgment in the judging process, they can escalate the issue once the judging period ends. They can challenge the exclusions or downgradings of finding to make sure they are paid their fair reward share.

Leaderboards & Ranks

After a contest, rewards are issued to the contestants. Payouts are made in USDC on both platforms and are usually issued a few days after the end of the escalation period. Furthermore, on Sherlock, contestants also receive points depending on their performance.

With the issuance of rewards, the leaderboards are updated. On Code4rena, the leaderboard is ranked by total payouts earned and also shows the amount of findings by severity. On Sherlock, contestants are ranked by the points they received over time.

While these leaderboards are nice for showcasing one’s skills, they also serve another useful purpose. On both platforms, only high-ranking auditors are allowed to join private contests. Additionally, high-ranking auditors on Sherlock can qualify for receiving guaranteed payouts and leading contests.

The resources

We have listed some resources which will help you to step up your auditing game. This includes auditing tools, literature and interesting people in the space.

Tools

A good craftsman is only as good as his tools. The same applies to developers who want to participate in audit contests.

• Mythril, a security analysis tool created by ConsenSys MythX
• Slither, a static analysis tool for Solidity created by Crytic
• Fuzzing tool for Rust created by Adrian Taylor
• Echidna, an Ethereum smart contract fuzzing tool created by Crytic
• Sūrya, a contract structure analysis tool created by ConsenSys Diligence
• C4udit, a static analysis tool specialized for Code4rena created by byterocket
• solstat, a static analysis tool for Solidity created by 0xKitsune

While the advantage of using these tools in audit contests is questionable as many auditors use these or similar tools, they can still provide good support for other security-related topics.

Good Reads & Resources

The best way to get into auditing is reading audit reports. Regardless of whether you want to start your own auditing business or join a contest on a decentralized audit platform, reading existing reports provides a better understanding of which vulnerabilities potentially exist, how they affect the functionality of the code, how they can be fixed, how vulnerabilities should be documented and sometimes also which tests were used to find them.

For an overview, we recommend the list with links to the audit reports of almost all major audit firms created by 0xNazgul. Apart from audit reports, there are also several further resources out there:

• Smart contract audit checklist created by tamjid0x01
• List of security vulnerabilities created by runtime verification
• Smart contract security verification standard created by Damian Rusinek & Paweł Kuryłowicz
• List of smart contract auditing heuristics created by OpenCoreCH
• Smart contract weakness classification created by SmartContractSecurity

People

The conversation on decentralized audits happens mostly in Discord or on Twitter. We have curated a list of people on Twitter who either rank high on leaderboards, post educational content or are relevant for other reasons. We suggest following them to stay in the loop about what happens in the decentralized audit space.

• Trust
• zarf.eth
• obront.eth
• pashov
• bytes032
• Liam
• StErMi
• Andy
• jeiwan.eth
• Christoph Michel
• RajΞΞv
• Patrick Collins
• Jack Sanford
• Mudit Gupta

We suggest following them to stay in the loop about what happens in the decentralized audit space.

Learning Platforms

There are also communities which support developers in their efforts to improve their auditing skills. Mostly, these communities are organized on Discord.

• Secureum, a community for learning about smart contract security
• Web3SecurityDAO, a DAO/community for learning about smart contract security
• SpearbitDAO, an audit DAO that also provides trainings to members

Conclusion

Becoming a decentralized auditor can be a great opportunity for skilled developers. The reward system for auditing smart contracts offers a good deal for those who can identify vulnerabilities in code. Financially, participating in audit contests can quickly pay off, especially for developers from low-income countries.

Additionally, being a decentralized auditor can provide valuable experience as auditors encounter a variety of protocols with different architectures and vulnerabilities. The process of participating in decentralized audits also fosters collaboration and knowledge sharing between auditors, providing a supportive community for those who wish to expand their skills and grow their network.

And even if you are not planning to spend your whole life doing decentralized audits, the experience gathered from seeing many different protocols from within alongside a good placement on one of the leaderboards definitely looks good on your resume when you decide to apply for new positions.

To close this article, we would like to once again emphasize the fact that becoming a decentralized auditor is not only a great opportunity for personal growth and income, but it also contributes to the overall security and trust in the crypto ecosystem. By working to find and fix vulnerabilities in smart contracts and protocols, auditors help prevent potential hacks and financial losses, which ultimately benefits the entire community. Moreover, having a larger pool of auditors, regardless of whether they work for a company or independently, creates more transparency and trust in the system, potentially attracting more investment into the crypto market.

Therefore, by becoming a decentralized auditor, one can not only gain valuable experience and income, but also play a significant role in promoting the safety and stability of the crypto industry. Become an ecosystem hero!

What’s next?

brainbot offers smart contract audits, but our security researchers also participate in audit contests. For some of the contests we participate in, we write recaps on HackMD which give insights on the code architecture, found vulnerabilities and potential solutions. We’d love to see you drop by and have a look!

Apart from that, we invite you to follow our Medium page, on which we frequently publish articles on what we do in the ecosystem. Thank you!

This article examines the consequences of possible hacker attacks on tokenized “crypto securities” under the German Electronic Securities Act (Gesetz über elektronische Wertpapiere — eWpG), emphasizing the importance of smart contract security from the issuers’ and register-keeping bodies’ perspective.

TL;DR

• The eWpG enables the issuing of “tokenized” electronic securities, potentially revolutionizing the way securities are traded and managed.
• Smart contracts are the software that enables token issuance and, therefore, are essential in the issuance of tokenized crypto securities (“Kryptowertpapiere”) based on the eWpG.
• The issuer and the register-keeping body of a crypto security register are supervised by BaFin and responsible for the integrity of the smart contracts that function as the forgery-proof recording system (“fälschungssicheres Aufzeichnungssystem”).
• To ensure that the register-keeping bodies maintain a secure system, they must implement strong security measures to prevent unauthorized access to the crypto securities register and the smart contract arrangement that supports it.
• The risk of the register-keeping body being hacked is real, and recovery of crypto securities can be a complex legal process. Smart contract audits by expert firms play a vital role in reducing this financial and reputational risk.

Background

The eWpG, which came into effect in Germany in July 2021, allows the issuance of certain bearer bonds and certain fund units in purely electronic format. The issuance of corporate stock in electronic format is going to follow.

Under the eWpG, electronic bearer instruments can be issued as “crypto securities” that are entered in a “crypto securities register”. This paves the way for various blockchain-based approaches. One of those approaches is for securities to be “tokenized”, potentially revolutionizing the way securities are traded and managed.

To meet the requirements of § 16 (1) of the eWpG, a crypto securities register must be kept on a forgery-proof recording system (“fälschungssicheres Aufzeichnungssystem”) in which data is logged chronologically and stored protected against unauthorized deletion and subsequent modification. Blockchain-based smart contract platforms like Ethereum are generally considered to have those properties.

Responsibilities of the Register-Keeping Body

The register-keeping body (“registerführende Stelle”) of the crypto securities register is whoever is named by the issuer of the respective security. If no such designation is made, the issuer is deemed to be the register-keeping body by default.

As the register-keeping body of a crypto securities register, the issuer or the service provider designated by the issuer must meet the specified regulatory requirements. According to § 11 eWpG, the register-keeping body of a crypto securities register is subordinate to BaFin supervision. It must ensure, according to § 7 eWpG:

• The crypto securities register accurately reflects the existing legal situation at all times.
• Entries and transfers are complete and correct.
• Necessary technical and organizational measures are taken to prevent data loss or unauthorized data modification.

The law also standardizes basic requirements for the IT infrastructure security of the electronic register. This concerns data protection but also data security. Outside of the statutory erasure regulations, once stored data must not be lost or suppressed and thus withdrawn from evidence.

In addition, the register-keeping body must ensure the protection of data integrity against manipulation by third parties, such as hacking attacks on the integrity of the securities register. To achieve this, it must use a state-of-the-art IT security system.

The guarantee of data protection, data security and data integrity is the basic requirement for the special trust in the register that justifies the legal authorization to issue crypto securities. Due to the statutory liability in § 21 (1) eWpG, the issuer can’t transfer this accountability (and liability) fully to a designated service provider. This means that although the issuer can contractually transfer its responsibility to a service provider internally, the issuer always remains responsible externally.

Role of smart contracts

Smart contracts play a significant role in the IT infrastructure required for the issuance of crypto securities. They allow issuing, transferring, and managing the tokens that are referenced as the units of crypto securities.

Smart contracts are the software scripts that are deployed as a forgery proof recording system on a blockchain network. The Ethereum blockchain with the ERC-20 standard is a well-known example for this, enabling developers to create tokens with just 100 lines of code. In particular, the name of the token, the token code, and the total number of tokens can be specified. Other parameters could be, for example:

• Decimals: Should usually be set to 0, since securities cannot be subdivided into fractions in the register.
• Timestamps: Can be set, e.g., for the time of expiry of the bond represented as a crypto security.
• A register-keeping body could set a kill() function which would be callable only by the register-keeping body’s address and which destructs the contract.
• A whitelist for eligible addresses could be implemented.
• A forceTransfer() function could be in place for only the register-keeping body’s address to call that basically allows the transfers of tokens without permission of the holder.

Any other logic compliant with eWpG and the terms of the respective crypto security could be programmed into the smart contract.

Possible Threat Scenarios

Despite the potential benefits of tokenization, there is always the risk of the register-keeping body or the holder of the token representing control of the crypto security being hacked. In such a scenario, an attacker could gain control of the entire smart contract or an individual account controlling tokens that represent the crypto securities. The attacker could then potentially manipulate the contract to transfer the securities to their own account.

Another attack vector could be a kill() function that is not validated, i.e., can be callable before expiry of the instrument.

In general, besides from forceTransfer(), most of the smart contract functions could be validated with storage parameters. This approach would be useful for setting certain functionalities as fixed, ensuring that they cannot be changed — not even by the owner. Moreover, any owner-dependent functionality should validate the owner’s parameters to prevent potential issues that could arise if the owner accidentally inputs incorrect information.

These and multiple other threat scenarios would be possible despite the fact that the Ordinance on Requirements for Electronic Securities Registers (eWpRV) stipulates in § 11 (1) eWpRV that anyone who issues instructions about electronic securities must prove their identity to the register-keeping body by providing suitable evidence. This requirement of identification would not be a sufficient protection because § 11 (6) eWpRV allows for the cryptographic signature to be regarded as suitable within the meaning of eWpG.

Therefore, it is essential that the register-keeping bodies implement and maintain strong security measures to prevent any unauthorized access to the crypto securities register and the smart contract arrangement that supports it. This includes regular security audits and updates to ensure that any vulnerabilities or weaknesses are promptly identified and addressed.

Recovery of the Assets

If the register-keeping body is hacked, the legal consequences can be complex.

According to § 18 (1) eWpG the register-keeping body may only make changes to the register on the basis of an instruction of the holder or by court decision. § 18 (5) eWpG, on the other hand, stipulates that if the register-maintaining body has made a change to the content of the register without an instruction, it must reverse the change immediately.

Depending on the type of attack conducted by a malicious actor, it may not be obvious right away whether or not an instruction was given. In a smart contract infrastructure that is required by law to have the ability to reverse transactions, individual tokens can be moved between accounts not only with the public/private key pair of the token holder. Therefore, the register-keeping body can be subject to legal uncertainty regarding its decision to reverse the transactions initiated by an alleged attacker or to wait for a court order.

Conclusion

The eWpG has paved the way for the tokenization of securities, which could potentially revolutionize the way securities are traded and managed. However, this also introduces new risks and challenges, particularly with respect to the security of the smart contracts that support these tokenized securities.

As such, it is critical that register-keeping bodies take proactive measures to ensure the security and integrity of their smart contract platforms, including conducting periodic smart contract audits and implementing appropriate security measures to prevent and mitigate potential threats. This can be achieved by consulting smart contract audit firms like brainbot as well as by hiring dedicated security experts.

By doing so, register-keeping bodies can help to maintain the trust and confidence of investors in these emerging markets and ensure that the potential benefits of tokenization can be fully realized.

TL;DR

• Project I — Whitebox: A project offering the ability to create and use open, transparent, and customizable social media feed algorithms on Lens, empowering users to control their content consumption and promoting a diverse information ecosystem.
• Project II — Greenroom: An all-in-one platform leveraging web3 identity primitives to streamline event organization and participation while enhancing on-chain reputation building.
• Project III — Gumrua: A web3 platform inspired by Gumroad, providing a user-friendly experience for creators to monetize their skills and sell digital goods without traditional barriers.

ETHPorto Hackathon 2023

In my previous blog post, I covered my three favorite talks at ETHPorto. In this post, I’ll cover my three favorite hackathon projects at ETHPorto.

I must say, watching the ETHPorto hackathon unfold was quite fascinating! Seeing so many skilled people (250+ hackers) team up and tackle challenges together was inspiring. The variety of compelling use cases they built within 48 hours was remarkable. It once again showcased the level of talent and innovation within the Ethereum community.

With an “Open Track” format, participants were encouraged to think outside the box and create projects with real-world impact. The top five teams shared a prize pool of 10,000 USDC, with the first-placed team taking home 5,000 USDC.

In addition to the Open Track, the EthPorto Hackathon featured a range of bounties provided by generous sponsors. These included Gnosis Chain, Sismo, Ethereum Foundation, Dataverse, Pyth, LayerX, Mantle, and Chainlink. The total bounties written out amounted to 27,000 USDC.

In this blog post, I’ll share my three favorite hackathon projects. These projects caught my attention for their creativity, practicality, and potential to impact industries.

Join me as we examine each project, discussing the pain points addressed, key features, and potential impact.

By the way, I am Tim, Venture Analyst at brainbot.

Project I — Legonisation of social media algorithms

First, I want to write about a project that particularly caught my attention: Whitebox. This project aims to revolutionize how we interact with content on social networking platforms by addressing the issues of social media feed algorithm monopolies.

Addressed pain point

Whitebox tackles the problems caused by the current content filtering algorithms in social networks, such as echo chambers, groupthink, low-value content, and polarization. These algorithms that dictate our content consumption are optimized for engagement, often leading to a narrow and biased worldview.

Key functionalities

Whitebox built a solution that lets users deploy and use open, transparent, and composable algorithms. These algorithms allow users to customize their content feed on Lens Protocol based on their preferences, helping them explore diverse perspectives and ultimately mitigating the harmful effects of existing algorithms. With Whitebox, users can create, edit, and save customized algorithms on-chain, ensuring transparency and user control over their content experience. The Lens Protocol integration allows content retrieval and filtering based on these user-defined algorithms.

Core value adds of the project are the following:

• Users have explicit control over what they see as lens feed.
• Users know precisely how posts get into their feeds.
• Users have certainty that algorithms are executed as written in code.
• Users can use third-party open-source algorithms for a more diverse content consumption experience.

Potential impact

Whitebox excited me because it empowers users to take control of their content consumption, breaking free from the limitations imposed by current algorithms. This project has the potential to significantly impact the way we consume content on social media and internet platforms by fostering a more open, diverse, and user-centric information ecosystem.

The concept of being able to choose your social feed algorithms was the argument that amazed me the most about the value proposition of decentralized social media in the first place.

Imagine you can select a feed according to your current mood and preferences. Picture you want to relax and have fun because your day was stressful. With this solution, you can select an algorithm that promotes funny and meme content. The same counts for other areas, you want to get the latest DeFi news, choose your algorithm accordingly. You want to learn swimming :D choose the respective algorithm. Besides that, you get the already outlined benefits: fewer echo chambers, less groupthink, and less polarization.

Whitebox is an example of how web3 can transform our digital experiences. I look forward to seeing how this project develops and contributes to a more transparent and user-controlled social media landscape.

Relevant links:

• Video demo
• GitHub repositories

Team:

• @0xbasedalex
• @OMPedr0_

Project II — Greenroom

Greenroom is a platform designed to innovate event participation by leveraging web3 identity primitives. The project plans to improve event organizer and participant experiences before, during, and after events, offering functions like event creation, on-chain reputation building, efficient onboarding, ticketing, automated payouts, and smart networking.

Addressed pain point

The problem Greenroom addresses is the disarray of participant experiences for tech events, primarily hackathons. Applications are non-reusable, tickets are sent via email, payments are processed through third-party providers, and networking often occurs off-platform. Greenroom’s solution can become an all-in-one platform, streamlining the entire process for event organizers and attendees.

Key functionalities

An event planner can establish an event with Greenroom’s smart contract by simply providing the event name, date, and paying a staking fee, which serves to deter bots and malicious participants. The event metadata is stored on IPFS to maintain a lightweight contract (I can imagine a lot of valuable functions that can/will be added to the smart contracts).

A user creates a single bio, represented by an NFT containing their skills as attributes. Additionally, this profile can aggregate information from other on-chain projects such as Otterspace, Lenster, Mazury, and Guild.xyz and previously earned POAPs from other events. This profile serves as application credentials for events, matchmaker to compose hackathon teams, and networking contact.

Potential impact

Greenroom’s potential to enhance the event experience for organizers and attendees made it stand out to me. By consolidating all event organization and participation aspects into one platform, Greenroom eliminates the need for multiple tools and services. Furthermore, its use of on-chain automation & reputation building can help streamline processes for organizers and participants.

I recently did a deep dive into the web3 identity space and concluded that the space currently faces a chicken and egg situation (no chicken, no egg). Such solutions are fueling the development of the web3 identity space at large. More use cases → more adoption → more use cases → more adoption.

Relevant links:

• Demo video
• GitHub

Project III — Gumrua

The last project I will highlight is Gumrua. Gumrua is a web3 platform inspired by the simplicity of Gumroad, a popular web2 platform for selling digital goods and educational content.

Addressed pain point

Gumrua addresses the problem of providing a seamless, user-friendly experience for creators to monetize their skills and sell digital goods without the need for traditional on-ramps/payment rails, KYC, or government permission.

Key functionalities

While listing a digital product, a new token is generated as an ERC1155 contract. When a product is purchased, a soulbond NFT is minted to grant access to the content. Gumrua utilized web2 storage and one-minute links to safeguard access, managed with NFT ownership verification on the server side. Integrations with Monerium and Safe allow users smooth on and off-ramping.

Potential impact

Gumrua did stand out to me due to its focus on empowering individuals to monetize their skills without traditional barriers. The project could transform how creators sell digital goods in general and in the crypto space.

Relevant links:

• Live product
• Demo video
• Pitch Deck

Team

• @carllippert
• @mattiapomelli

Final thoughts

The ETHPorto Hackathon 2023 truly showcased the talent and creativity within the Ethereum community. The three projects highlighted in this blog post — Whitebox, Greenroom, and Gumrua — are prime examples of the potential of web3 to reshape various aspects of our (digital) lives.

Whitebox’s user-controlled social media algorithms can revolutionize content consumption, creating a more transparent and user-centric landscape. Greenroom has the potential to simplify event organization and participation, making the overall experience more seamless and enjoyable for both organizers and attendees. And Gumrua aims to empower creators to monetize their skills without traditional barriers, ultimately leading to greater individual autonomy and financial freedom.

Remember that these projects represent just a tiny sample of the innovative solutions born during the hackathon. There were many other projects, each with unique potential for impact. As the Ethereum ecosystem continues to grow and mature, we can only expect to see more groundbreaking ideas and applications that will drive the adoption and success of web3.

The ETHPorto Hackathon 2023 has left me feeling inspired and optimistic about the future of the Ethereum community, and I cannot wait for the next opportunity to witness such a display of talent and innovation. Keep an eye on these projects and others like them, as they will likely shape the Internet of tomorrow.

I would love to know what your thoughts are on these projects. Comment here or message me on Twitter or LinkedIn.

Last remark: As a web3 venture builder, we are always open to building ventures jointly with founders. Let me know if this blog post triggered a venture idea within you (or if you have one in general).

Follow us on LinkedIn and Twitter, or subscribe to our newsletter to learn about brainbot, our ventures, and the Founders in Residence program.

We’ll tell you how decentralised smart contract audits work and explain why they will become an integral part of web3 security, complementing traditional audits.

Smart contract security is crucial and should not be compromised. Recent exploits painfully disclosed the consequences of neglected security measures and lifted demand for smart contract audits onto another level. While traditional audit firms still dominate the market, the concept of ‘decentralized smart contract audits’ has caught up quickly in recent months. The concept reclaims long-established values of the crypto community like decentralization and transparency.

In this article we explain the idea, the process, the appeal, the trade-offs, and the impact of platforms enabling decentralized audits. In conclusion, we suggest a hybrid approach to increase smart contract security.

The idea

This article aims to take a peek at the future of smart contract audits. Before getting there, let’s take a detailed look at the phenomenon of ‘decentralized audits’.

The concept came up in early 2021. It is based on permissionless platforms that enable developer teams to reward others to review their code. This embraces the idea that skilled people all around the globe should be able to join forces to audit code. The approach enhances the security of decentralized applications by leveraging swarm intelligence. It does so, without requiring contributors to work for a dedicated smart contract audit firm. Hence the term `decentralized audits`.

Demand for audits surged when cryptocurrency rallies led to drastic increases of the value locked in smart contracts. These open audit platforms meet the increased demand by enabling contributors to earn additional income. They can independently submit their findings to audits, either in their free time or even full-time.

The process

The key feature of these decentralized audit platforms is their openness. They allow anyone to register as an auditor — anonymously and without any kind of skills assessment — all within just a few minutes. If contributors decide to participate in a certain audit, they get access to the code to be audited and can start right away to submit tickets for each vulnerability they find.

Each audit is conducted in contest format. Findings are submitted in tickets — privately and only disclosed to the public once the contest is over. Each ticket contains information on the detected vulnerability, potential consequences, a severity rating and a possible mitigation measure.

Each audit contest runs for a predefined number of days. After the deadline, all findings are collected and evaluated. The evaluation process is conducted by senior members of the platform. Depending on the platform and the audit scope, the process is also supported by other contributors since (especially for large audit scopes) the number of submitted findings can reach up to several hundreds.

Once the preliminary results are published, a challenge period starts, in which auditors can raise disputes. Disputes are often raised if auditors feel like submissions have not been rated correctly, which in turn could affect their rewards. Succeeding this period, the final results are published and an audit report is compiled. Auditors are then rewarded for their contributions with a payout, and, if applicable, ranking points.

“Decentralized audits are ideal also for digital nomads.”

In combination with low entry barriers, the convenience of the auditing process explains why the concept is so attractive for developers and security researchers alike. Accounts on the respective platforms are usually linked to public keys on Ethereum. Contributors also need a Discord as well as a Github account. Besides that, no further resources or investments are required. This is ideal also for digital nomads.

The appeal

Now let’s take a step back to understand why decentralized audits have gained so much popularity over the last year — for developers and smart contract security researchers.

The most obvious aspect is the financial side of smart contract security. Due to the demand for smart contract audits skyrocketing, daily rates for auditors of well-renowned auditing companies saw strong hikes. The total costs for a smart contract audit depend on the daily rates for the auditors and the time they require to conduct the audit. The latter depends on the length and complexity of the code. Usually, the code is audited independently by at least two auditors to maintain the four-eyes-principle. With daily rates of up to US$5k per auditor, audits tend to become expensive very quickly. In case a large number of issues needs to be resolved, auditors may also request additional time. While this is usually worth it as these auditors have extensive experience, it is often tough to afford for smaller or nascent projects.

Contributing to their appeal is the fact that decentralized audits use a different approach compared to ‘traditional’ audits. On the platform, the requesting development team provides a contest reward pool with a fixed amount of money that is distributed to auditors for submitting issues and to the platform for reviewing submissions and creating the final audit report. Through this approach, companies can have more auditors look at the code for lower cost.

Another aspect differentiating decentralized audits is: Less waiting time. Despite the high daily rates, most auditing companies were overwhelmed by the numerous audit requests they received during the spikes in 2022. In that time, some auditing firms accumulated backlogs of more than six months. Since many projects desire to get audited before releasing on mainnet or simply feel the pressure from stakeholders to provide an audit report, time is very valuable. For cases like these, decentralized audits offer a great alternative as almost no waiting times are necessary. Since all major platforms rely on a large pool of auditors, capacity is rarely a problem, allowing platforms to move quickly and start audits within less than a week.

“Decentralized audits come with the promise of embodying openness and transparency.”

Lastly, decentralized audits come with the promise of embodying openness and transparency. These are key values of web3 and decentralized systems. It may not be an important aspect to most, yet it is interesting to keep in mind, as the promise of security in decentralized systems originates from the full availability of information to all participants of the network. “Many eyes will win the prize” — also when it comes to audits.

In conclusion, decentralized audits pose a great alternative, especially when it comes to financial and time constraints.

The trade-offs

There’s no such thing as a free lunch — decentralized audits also come with some trade-offs.

First and foremost, quality is crucial when it comes to audits. High quality, however, is difficult to guarantee for decentralized audit platforms. They rely on the interest of their auditors to participate in each contest — auditors need to actively join each audit and cannot be forced to participate. That means that if a contest is not interesting enough for top auditors, the audit will be conducted by a large number of less experienced contributors. This does not necessarily mean that the quality of the report will suffer, especially since every audit has at least one senior member assigned. Yet, the likelihood that a severe issue is overlooked increases.

On the other hand, the quality of decentralized audits may be lacking because some auditors only cover selected parts of the smart contract to be audited. Especially for large projects, the workload of auditing the entire code might be overwhelming for an individual. This increases the risk of overlooking vulnerabilities created by complex interplay of several smart contracts.

Another downside is the effort required by the audited project. During ‘traditional’ audits, the development team of the project is required to provide assistance and to answer questions to the auditors. This is often limited to one or two meetings during the audit process or a few messages. In decentralized audits, however, developers need to be active on the respective platforms most of the time. Since auditors work independently, questions are often asked multiple times, and as auditors on average are less experienced, more questions are asked in total.

The rather abstract concept of reputation also plays a role in audits. Simply put, you pay a premium to get your audit from a well-renowned auditing company as their audits are perceived to have a higher quality. Justified or not, this does matter to some. It also signals that your project is willing to invest big in security. Decentralized audits may not come with that reputational benefit.

The impact

Decentralized audits will be an integral part of the auditing landscape of the future. To be precise: Decentralized audits will conquer the niche of first-time audits. The reasoning is fairly simple.

“Decentralized audits will conquer the niche of first-time audits.”

The share of top auditors working independently on decentralized audits platforms will continue to grow, increasing the overall quality of decentralized audits. Meanwhile, waiting times can be expected to stay comparably short. Growing reward pools will make decentralized audits more expensive, but they will stay at affordable levels. However, a reward increase will be required to keep audits interesting for top security researchers despite the constant inflow of new and less experienced auditors.

The combination of these developments is highly attractive for projects, yet we predict that decentralized audits will mainly be utilized as first-time audits. This is due to the different characteristics of ‘traditional’ and decentralized audits outlined above. Regular audits cover great depths and thus have a greater chance to find high severity vulnerabilities. Decentralized audits on the other hand tend to be “broader”: the sheer number of auditors will likely find a higher number of low and medium severity vulnerabilities. Considering that specifically in first-time audits there may be many smaller issues of lower severity, like gas optimization, this may lead to an auditing firm requesting additional time, while for decentralized audits these smaller issues may also be covered by the initial reward pool.

Nevertheless, many projects will continue to rely on names and prestige of established auditing companies. This level of prestige is yet to be matched by decentralized audit platforms and might as well never be reached at all. Yet, this does not do any harm to the general appeal of the concept.

The hybrid approach

Our advice to developer teams is to make use of a hybrid approach for audits:

• Decentralized audit,
• Traditional audit,
• Bug bounty.

Ideally, a project should get at least two independent audit reports anyway. It can come in very handy to utilize a decentralized audit platform to conduct the first audit. At a later stage, we recommend a second audit by a different entity, preferably by an experienced audit firm.

“The earlier security is made the top priority, the cheaper and easier the audit process will be.”

Regardless of audits, however, we recommend that you involve a dedicated security expert into your project as soon as possible. The earlier the security of a project is made the top priority, the cheaper and easier the audit process will be. This can be achieved, for example, by getting assistance on conceptualizing a secure smart contract architecture. You can find out more about our smart contract security-related efforts on our website.

The hybrid approach is rounded off by a bug bounty that incentivises white hat hackers to continuously stay on top of even the deployed ‘live’ instances of the project’s code.

The platforms

The current decentralized audit space is dominated by two platforms, Code4rena and Sherlock. This section will cover both of them as well as other players in the smart contract security space.

Decentralized Audit Platforms

The pioneer among decentralized audit platforms is undoubtedly Code4rena. They started in February 2021 by launching the audit of Elastic DAO as their first decentralized audit. Following this first shot, the platform took off and gained significant traction in April 2021, reaching over 100 active auditors by the end of the year and over 1,000 active auditors by March 2023. To date, Code4rena is the most important platform for decentralized audits. Its concept is the most original one: Companies provide a reward pool and anyone can participate. Auditors get scored based on their performance and can move up the leaderboard. They also offer private audits, in which only selected auditors can participate (useful for stealth startups or confidential projects).

The second biggest platform is Sherlock. Sherlock started only in August of 2022, but quickly caught up to secure a top spot in the space. Sherlock mainly follows the original concept of decentralized audits as well, but they only reward their auditors for medium and high severity vulnerabilities. Their overall approach, however, has a little twist: Audited protocols have the opportunity to get insurance by Sherlock. This way, Sherlock has some “skin in the game”, which is probably the best incentive for them to strive for the highest possible quality of their audits.

Bug Bounty Platforms

Apart from audits, bug bounty platforms are another approach to secure smart contracts. Instead of competitions for a reward pool during a fixed period of time, bug bounty platforms enable projects to provide bug bounties to white hat hackers and auditors in exchange for reported vulnerabilities. Bug bounties are usually available for an unlimited time and a fixed amount is paid per finding, there is no competition for a predefined pool of rewards.

From the perspective of projects, this has the advantage that bounties only have to be paid if a vulnerability is found and furthermore, bug bounties incentivise individuals to disclose (randomly) found vulnerabilities with the project’s developer team instead of exploiting their finding. On the other hand, auditors are not as encouraged to audit the protocol as bounties for small findings are often neglectible and there are no contests with support from the development team of the respective project. To mitigate these disadvantages, bug bounties are often combined with audits, usually launching some time after the completion of the audit.

Relevant platforms to date are Immunefi, Saloon Finance and Bugcrowd.

Audit DAOs

Audit DAOs are a mix of regular auditing companies and decentralized audit platforms. The DAOs consist of several independent auditors, which form a team to conduct an audit. Joining criteria for the DAOs ensure a high skill level of auditors, which allows them to take on requests in the way of an auditing company while keeping a decentralized setup. Notable examples are Spearbit DAO and NinjAudit (NinjAudit was founded by high-ranking auditors on Code4rena and Sherlock).

Auditor Pooling Platforms

To date, only AuditOne uses this approach. Essentially, they work similar to audit DAOs, except that they are not organized in a decentralized way.

What’s next?

This article summarizes the state of the decentralized security space, mainly from a developer team/project perspective.

In the near future, we will release a second article focused on auditors, including the process from the auditor’s perspective, a short introduction on how to start with decentralized audits and resources to improve your auditing skills.

Additionally, we will shortly start publishing a series of articles summarizing decentralized audit contests we participated in on HackMD.

TL;DR

Talk I — Oly combines a self-custodial hardware wallet with a Visa debit card to integrate on-chain assets with everyday real-world transactions.

Talk II — Monerium provides a bank account number (IBAN) for web3 wallets, enabling users to send and receive euros between any bank account and web3 wallet.

Talk III — dm3 protocol, a public good, aims to make web3 messaging practices interoperable.

ETHPorto 2023

Picture this: a beautiful coastal city with stunning architecture, rich history, and a vibrant atmosphere. Now picture it hosting 700 attendees, all eager to share their knowledge about the latest trends in web3.

That’s what happened at the first-ever ETHPorto conference (16–18/03/2023), an event that brought together many bright minds in the Ethereum ecosystem.

The city’s charm influenced the conference atmosphere, making it a delightful experience. The event featured an incredible lineup of projects, thought-provoking presentations, and side events.

Out of the 20 talks I attended, there were three that particularly caught my attention.

Get comfortable, grab coffee (or maybe port wine), and join me as we dive into the three talks.

By the way, I am Tim, Venture Analyst at brainbot.

Talk I — Bridging the gap to real-world payments with Oly.network

In this talk, Stefan George from Gnosis Chain discussed the challenges web3 faces related to use case adoption. He argued that web3 has not so much of a scaling issue, but rather a use case issue. Stefan contended that the real challenge lies in finding relevant use cases combined with an exceptional user experience that can bring decentralized technology’s benefits to everyday life.

He presented Oly.network, which could be one way to address this. Oly is a product that unites a self-custodial hardware wallet and a Visa debit card. The Oly card is a hardware wallet that holds the key to a self-custodial wallet on Gnosis Chain. Users can pay with the card anywhere Visa is accepted (licensed to pay at more than 60 million merchants worldwide). The card/hardware wallet can store any traditional crypto asset and execute transactions using wxDAI, a stablecoin pegged to the USD. This solution is excellent for integrating on-chain assets with everyday real-world transactions.

He stated that besides seamlessly integrating on-chain assets with everyday real-world transactions, such a product could also provide the rails for more advanced loyalty systems.

That made me think. An on-chain loyalty system integrated with Visa card payments could be an appealing solution for customers and businesses seeking a more efficient, rewarding, and engaging loyalty program.

Value adds from a customer perspective — With such a system, customers can effortlessly earn (loyalty) tokens or NFTs with every transaction. There is no need for an additional platform to register and monitor/redeem points. Everything is already integrated into the user’s wallet. In this way, businesses offer a loyalty system by default, likely creating more value for their customers. Furthermore, to reward customers, businesses could provide on-chain rewards like ETH, NFTs or token-gated experience on top of traditional benefits.

Value adds from a business perspective — With such a system, reward management for businesses is streamlined by plug-and-play process automation and analytics. Moreover, an on-chain loyalty system provides valuable insights into customer on-chain behavior, enabling companies to tailor their marketing strategies and drive engagement. It also allows to easily implement collaborative merchant ecosystems (partnerships, cross-promotions, and shared growth), further improving customer experience.

There are many friction points to overcome here, but the vision seems appealing.

My bottom line: Oly is a great step to dismantling the boundaries between on-chain and off-chain transactions. The widespread adoption of solutions like Oly could significantly shift how consumers and businesses interact with self-custodied assets and web3 daily, fostering mainstream acceptance and driving growth for the web3 ecosystem.

Talk II — Bank Account Number (IBAN) for Your Wallet by Gísli Kristjánsson

Following Stefan George’s talk about bridging the gap between the decentralized & real world, Gísli Kristjánsson, CTO of Monerium, presented another solution to connect traditional banking and web3.

Gísli introduced the concept of a bank account number (IBAN) for web3 wallets combined with Monerium’s EURe token, an authorized and regulated euro stablecoin (available on Ethereum, Polygon, and Gnosis chain). This combination allows users to send and receive euros between any bank account and web3 wallet.

Monerium’s service automatically mints EURe tokens on-chain when receiving a SEPA payment. Conversely, sending EURe from a wallet to a traditional bank account works by signing an on-chain transaction (EURe is burned, and the euro amount is sent via SEPA to any bank account).

Additionally, integrations and partnerships with Safe and Request Finance enable off-chain invoicing, payroll, and expense reimbursement on-chain. The EURe token is also tradable on Curve, which enables direct access to the broader web3 ecosystem. This allows for a frictionless interplay between digital and traditional assets, e.g., continually earning on-chain yield while quickly utilizing the off-ramping capabilities when needed.

Monerium’s EURe is more than a classic stablecoin. As an Electronic Money Institution (EMI), Monerium is regulated and authorized to issue e-money tokens on blockchains. Each EURe token is 102% backed and safeguarded, providing legal clarity and secure storage for user funds. The solution is available for individuals and companies in the European Economic Area, the UK, and Switzerland.

My bottom line: Monerium’s web3 wallet IBANs can drive mainstream adoption and simplify transitioning from on to off-chain and vice versa. This structure will unlock new use cases and create a more inclusive and accessible financial ecosystem.

Talk III — Interoperability initiative with dm3. Unified messaging across web3

In the third talk, Steffen Kux and Eduardo Vega-Patiño from Corpus.io/dm3 protocol discussed eliminating all the different messenger apps on our smartphones.

The talk focused on the dm3 protocol, a collaborative effort to build a public good for interoperable web3 messaging. The protocol is open-source and connects existing and new messaging standards.

The dm3 protocol can serve as a base layer to connect various communication standards and options, including website widgets, customer service embedded chats, group chats, or p2p communication. Such a solution will allow users to communicate across different ecosystems, applications, and services without compromising who they can communicate with. Such a frictionless user experience is superior to the currently siloed communication practices in web2.

Steffen and Eduardo also emphasized that avoiding silos is not the only core value of the dm3 protocol, it also prioritizes interoperability, decentralization, and encryption — all essential properties for a frictionless, secure, and privacy-preserving user experience.

My bottom line: The dm3 protocol could become critical infrastructure for unified web3 messaging. The widespread adoption of dm3 (as a public good) would add value to the entire web3 ecosystem.

Final thoughts

ETHPorto was an exciting event showcasing innovative solutions and developments in the Ethereum ecosystem. The three talks highlighted in this blog cover just a few of these developments. All ETHPorto talks will be shared online at a later stage.

As ETHPorto 2023 ended, there was a feeling of excitement in the air as attendees reflected on the talks, valuable connections made, and the potential for future collaborations. The closing party was a fun and lively event, with people from all over the world coming together to celebrate the success of the conference and hackathon.

As the night drew to a close, there was already talk of next year’s ETHPorto conference. As I left the party, I felt grateful for the opportunity to attend ETHPorto 2023 and experience the city's charm. The conference left a lasting impression, and I look forward to seeing what the future holds for the ETHPorto community.

I would love to know your thoughts on these projects and trends. Comment here or message me on Twitter or LinkedIn.

I will soon release a blog post about the hackathon during ETHPorto. I look forward to sharing some of the most exciting projects with you.

Last remark — As a web3 venture builder, we are always open to building ventures with founders. Let me know if this blog post triggered a venture idea within you (or if you have one in general).

Follow us on LinkedIn and Twitter, or subscribe to our newsletter to learn about brainbot, our ventures, and the Founders in Residence program.

Finding Product Market Fit

As a web3 founder, finding product-market fit is crucial for the success of your business. CB Insights found that 35% of ventures simply fail due to no need for their service.

Product-market fit refers to the state in which your product resolves a pain point and meets a demand. It is the spot where your product provides customers value and sells repeatedly.

Identifying A Pain Point

While starting, you are dealing mostly with assumptions about paint points your potential customers have, not with facts.

To test these assumptions, it’s important to start by understanding your target audience. This means primarily conducting interviews with your potential customers to identify their pain points.

Also include secondary data like industry reports, on-chain data, twitter threads and blog articles. Focus only on the needs, problems, and pain points during this part of the process.

In this video, Grace Ng demonstrates a clear way to test assumptions related to problem, solution and customer.

Developing A Solution

Based on your findings, you should outline a solution and (in)validate it through testing. The question to answer here: Can your solution resolve an identified pain point?

This is possible through surveys, interviews, and by testing a low fidelity minimum viable product (MVP) (e.g. landing page or click dummy) with a few customers. Testing will provide valuable feedback on whether your product idea resonates with the market and encounters desirability.

Once you have an understanding of your target audience and a validated idea, you can start to build. This means building a high-fidelity MVP that includes only the essential features identified during testing. In this phase, you should also define and test different pricing and marketing strategies.

Finding product-market fit is a continuous process. It requires ongoing research, testing, and iteration. Be agile and willing to make changes to your product and business model as needed. All in order to meet the needs of your customers and succeed in the market.

This advice is derived from the “Lean Startup” methodology. You can learn more from Steve Blank and Eric Ries, the inventors of the Lean Startup movement.

Note, that in the crypto industry, the hype around tokens can make it difficult to determine if a product meets real market needs. Users may only use a service to qualify for a potential airdrop, leading to false conclusions about the product-market fit. Even after a token launch, users may still hold the token purely for speculative purposes, meaning that they may not have any real interest in the product but are merely looking to sell the token as soon value increases. This not only muddies the waters in terms of assessing product-market fit but can also result in a volatile secondary token market that is heavily influenced by speculation.

Raising Capital

As a web3 founder, raising capital is an essential step in starting/growing your business. Capital refers to the funds that a company uses to finance its operations, investments, and growth.

There are several ways to raise capital, including:

• Bootstrapping: Using your own personal savings, credit, revenue from sales, or asking family and friends to finance your business.
• Crowdfunding: Raising small amounts of money from numerous people, often through online platforms or a public token sale.
• Angel investors: Approaching individuals who invest their money in startups in exchange for equity or/and tokens.
• Venture capital: Funding from firms that invest in high-growth startups in exchange for equity or/and tokens.
• Bank loans: Borrowing money from a bank or other financial institution and repaying it with interest.

Raising capital is often a major challenge for web3 founders. Andreessen Horowitz (a16z) for example, a well-known venture capital fund, only funds 0.7% of all inbound applications.

To increase your chances, good preparation is key. This means putting in the effort to create a solid business plan, research investors, and optimize for a compelling pitch. It also means preparing to answer tough questions and adjusting your plan.

Guiding questions

Here are guiding questions to think about while preparing a pitch for investor meetings:

• What pain point are you addressing? How intense is the pain? How did you validate this pain point assumption?
• What’s the job to be done to resolve/reduce this pain point? How will your solution add value/address the pain point?
• How many people/companies experience this pain point? How do they solve it right now?
• Why now? Is there a “window of opportunity” opening up?
• What does the competitive landscape look like? What is your unfair advantage? What is your right to play?
• What makes your team the perfect match? Is there a “team-product-fit”?
• How do you plan to enter the market?
• What do financial model/unit economics look like?
• For what do you need the funds which you are asking for?
• What are the potential risks and challenges?

Check out the 10/20/30 Pitch deck rule of Guy Kawasaki for additional insights.

Building relationships

It also helps to focus on building relationships with potential investors -networking, attending events, and proactively reaching out to investors. Always be prepared to answer the above-outlined questions. By doing so, you can build trust with investors, and increase your chances of funding.

Building a Strong Team in web3

As a web3 founder, one of the most crucial challenges you will face is building a strong team. According to our primary research, 20% of founders face the problem of finding the right co-founder and/or team members.

You need to find individuals who not only have the right skills, but who also share your vision and are willing to work together to achieve it. To overcome this challenge, you should focus on the following five pillars: Be proactive in your search for the right people. Focus on creating a diverse team. Be effective in communication. Invest in training and development. Leverage the Broaden-and-Build theory.

Proactive Search

Being proactive in your search entails networking, attending events, using job boards, and being active on socials. It also demands being clear about what you are looking for in a team member, to be able to communicate your needs.

Team diversity

Focus on diversity requires looking for different backgrounds, experiences, and perspectives. A truly diverse team is likely to come up with more innovative and creative solutions to problems. Such a team will consider a wider range of options and perspectives, leading to more well-informed decisions. A diverse team can also develop a better understanding of the needs of a diverse customer base.

Effective communication

Effective communication and collaboration includes fostering an open and honest way of interacting. Encouraging team members to share their ideas and feedback. And providing direction and goals, ensuring that everyone understands their responsibilities. By doing so, you can foster teamwork and ensure that everyone is working towards the same goals.

Training and development

To invest in training and development means providing opportunities to learn and grow. Offering support and resources to help your team achieve its goals. It also includes providing feedback, recognition, and promoting constructive criticism. These investments create a positive culture and help your team achieve its full potential.

Broaden-and-Build

According to the theory, experiencing positive emotions expands awareness and allows exploring new ideas and opportunities. This “broadening” effect helps to build new skills, knowledge, and resources. The theory is supported by a number of studies, which have found that positive emotions are linked to increased creativity, problem-solving ability, productivity, and resilience.

To profit from the Broaden-and-Build effect in your team, you can:

• Encourage chit-chat and games — Many companies permit activities such as playing games, participating in sports, or engaging in casual conversation because it has been scientifically proven to improve productivity, reduce stress, boost creativity, and foster teamwork. It is not just a public relations tactic.
• Lead by example — As a leader, model positivity and optimism, and encourage others to do the same.
• Encourage positive emotions — Create an environment where team members feel safe to express positive emotions and share good news.
• Facilitate collaboration — This can be achieved through brainstorming sessions, cross-functional teams, and company-wide problem-solving efforts.
• Provide autonomy — Give team members the freedom to take ownership of their work and make decisions. This will help them to feel more engaged and motivated.

In addition to these points, it can also be advantageous to offer core team members (equity) stakes in the venture. Here, token allocations or an Employee Stock Ownership Plan (ESOP) can be utilized. Such measures help to align the interests of employees with the interest of the founder and investors, as the success of the company directly affects the value of the employees’ token or equity share.

Conclusion

Building a venture can be a challenging and demanding process. You can increase your chances of success by focusing on finding product market fit, raising capital, and building a solid team. Support from a venture builder can be valuable here. By providing access to all kinds of resources like capital, mentorship, infrastructure, network, and expertise, a venture builder can help to overcome challenges and help you to become a successful entrepreneur.

Are you a founder who is interested in launching and scaling a web3 venture? Learn more about our venture builder activities.

In this blog post, we only scratched the surface of each of these three challenges. In upcoming blog posts, you can expect us to share extra guidance that helps you to overcome more typical founder challenges. Stay tuned!

In the meantime, follow us on LinkedIn and Twitter and subscribe to our newsletter to learn about our Founders in Residence program and our ventures.

Gas optimisation matters

Optimising the gas usage of smart contracts is a substantial aspect when it comes to developing successful decentralised applications. This has mainly financial reasons since every unit of gas comes with a (dynamic) price and even though the gas price on Ethereum is bearable at the moment (~35 gwei at the time of writing), it is very volatile and can change rapidly based on market conditions. In the 2021 bull run, users had to pay up to 20$ for simple transactions when gas prices moved around 200 gwei and more.

High gas costs affect both sides of your project’s balance sheet: First, they ruin user experience and potentially scare away people from using your application or even cryptocurrencies at all, reducing revenue. Second, depending on how much gas executing your smart contracts requires, your costs will surge unless you increase fees, which will again affect your revenue.

To make it short, gas optimisation matters. For that very reason, we do not only look at potential vulnerabilities when we conduct code audits for our clients, but also provide recommendations on how to reduce gas spending. Through those audits as well as our own development efforts for various projects, we have piled up significant experience and tips on how to optimise gas usage, of which we will share some in this post for you to inherit.

You can learn more about the smart contract code audits or the development support we provide to our clients here:

Professional Services

A brief introduction to gas

If you are asking yourself what gas is, this section is meant to give you a brief overview. If you are familiar with the concept of gas, you can skip to the next chapter.

Executing code on the blockchain requires computational efforts, for which you have to pay a fee. On Ethereum (and most other blockchains) this fee is called gas. The amount of gas you need to pay depends on the computational resources required for executing the smart contract. The price of gas then depends on the current demand in the network and the value of Ether, Ethereum’s native token.

While one cannot influence the price of Ether or the demand on the network, reducing the need for computational resources is a common approach. Gas optimisation thus aims to reduce the cost of executing smart contract code by streamlining the code according to the way it is processed on-chain.

If you want to get a more in-depth understanding, we recommend to stop by the explainer page on ethereum.org, which additionally provides a list of further readings.

9 ways to optimise gas usage

This is probably the part you’re here for. Each way will introduced briefly, followed by an example. Let’s jump in!

1. Use small variables for storage

Storage is tightly packed, meaning two variables following each other that can fit in a word (256 bits in the EVM) will be made into a single storage slot. As such if you use variables smaller than 256 bits, you may be able to declare them in a way to save storage slots. This can be especially relevant when defining structs that are going to be used multiple times.

contract Storage {
    uint256 a;
    uint256 b;
    function inefficient(uint256 _a, uint256 _b) external {
        a = _a;
        b = _b;
    }
    uint128 c;
    uint128 d;
    function efficient(uint128 _c, uint128 _d) external {
        c = _c;
        d = _d;
    }
}

Tightly pack your structs:

struct fourWords {
    uint256 a;
    uint128 b;
    uint256 c;
    uint128 d;
}
struct threeWords {
    uint256 a;
    uint256 c;
    uint128 b;
    uint128 d;
}

2. Don’t use too small variables for storage

The problem with using smaller variable for storage is that when the variables are loaded and stored, they need to be rescaled to and from 256 bits EVM words that the EVM manipulates. This costs gas on every load / store.

The tradeoff is between saving storage costs or computation costs. Variables that are frequently read and stored should be written in a full word when possible.

OpenZeppelin uses uint(1) and uint(2) instead of a true/false boolean for a frequently used storage variable. As documented, they avoid using 0 to avoid the gas refund that usually comes when bringing a storage variable from non-zero to zero. As the gas refunded in a transaction is limited by a fraction of the total transaction gas, this potentially saves gas.

contract Storage2 {
    uint128 a = 1;
    uint256 b = 2;
    function inefficient(uint128 _a) external {
        a += _a;
    }
    function efficient(uint256 _b) external {
        b += _b;
    }
}

3. Reading storage multiple times

Accessing storage costs 2100 gas for the first read and 100 gas per additional read (cold SLOAD / warm storage read). If you need to access the same storage variable multiple times, you can put it in memory and read it from there instead. This should cost 3 gas (MSTORE) and 3 additional gas per read (MLOAD). It is particularly remarkable when using the length of a storage array in a for loop

contract Gas {
    
    uint256[] arrayOfNumbers = [1, 2, 3, 4, 5];
    function forLoop() external {
        // costs 2100 gas + 100 gas per iteration
        for(uint256 i = 0; i < arrayOfNumbers.length; i++) {
        }
    }
    function forLoopEfficient() external {
        // costs 3 gas + 3 gas per iteration
        uint256 arrayLength = arrayOfNumbers.length;
        for(uint256 i = 0; i < arrayLength; i++) {
        }
    }
}

4. Use calldata instead of memory arguments

Similarly to using memory instead of storage when possible, arguments of external functions should be left in calldata instead of memory to reduce gas costs. Defining arguments as memory will require the arguments to be loaded into memory, adding an additional MSTORE as well as an additional MLOAD every time it is read. This is only required if you need to modify the argument of the function inside the function. The gas saved by using calldatainstead of memory is proportional to the size of argument and depends on the usage of memory in the rest of the function (see memory expansion).

function inefficient(uint256[] memory a) external {
    }
    function efficient(uint256[] calldata a) external {
    }

5. Use immutable or constant instead of storage

To save storage costs, you can declare variables that you set only once as immutable or constant instead. An immutable variable is set only in the constructor and does not use storage. This will save 20000 gas on deployment as well as 2100 gas whenever the immutable is read + 100 gas per additional read in the same transaction.

contract Immutable {
    uint256 a;
    uint256 immutable b;
    constructor(uint _b) {
        a = _b;  // 20k gas
        b = _b;  // 0 gas
    }
    function inefficient() external returns (uint) {
        return a;  // 2100 gas
    }
    function efficient() external returns (uint) {
        return b;  // 0 gas
    }
}

6. Use custom errors

Instead of reverting with a string, in solidity 0.8.4 and up you can use custom errors to save gas. The custom error will revert with the signature of the selector of the declared error in memory, while a revert with a string will revert with the selector of Error(string)and the ABI-encoded string in memory. Gas is also saved on deployment by not having to save the string.

The following example saves about 252 gas on execution.

contract Error {
    error Test();
    function inefficient() external {
        revert("Test");
    }
    function efficient() external {
        revert Test();
    }
}

7. Use ++i instead of i++

It costs 5 less gas to use ++i and --i than i++ and i--. This is especially relevant in for loops.

function inefficient() external {
        for (uint256 i = 0; i < 10; i++);
    }
    function efficient() external {
         for (uint256 i = 0; i < 10; ++i);
    }
}

8. Don’t compare to boolean literals

It saves about 15 gas to replace if (x == true) with if (x) and if (x == false) with if (!x).

bool constant x = false;
    function inefficient() external {
        if (x == true) {
            revert();
        }
    }
    function efficient() external {
        if (x) {
            revert();
        }
    }

9. Make functions payable

Payable functions cost about 21 less gas to be called than non-payable function. This is due to having to check the message value in non-payable function and revert if it is not 0. Contracts with payable functions are also cheaper to deploy.

function inefficient() external {
    }
    function efficient() external payable {
    }

Stay up to date for part 2!

We are planning to publish further articles on gas optimisation in the future. If you liked this post, we recommend to follow our medium profile to stay up to date on any new publications.

About the author

This blog post was created by Côme du Crest, Developer & Auditor at brainbot technologies AG. For questions, please reach out to services@brainbot.com and mention the keyword „gas optimisation“.

At brainbot, we envision a world in which decentralized peer-to-peer technology empowers people to self-organize effectively, so they are less reliant on top-down power structures and their negative side effects. That’s why we are developing open source building blocks for the Ethereum ecosystem like Raiden, Beamer, Shutter and POWdump, as well as the people-powered-money network Trustlines. In this article you’ll learn more about what’s next for us, how we want to help grow the crypto economy, and our team.

Our Foundations

brainbot has been around for a while. It was founded in the year 2000. After developing Internet search engine technology in the founding years, we pivoted to contributing to the (then nascent) Ethereum ecosystem in 2014. In that phase, we programmed the initial versions of the Ethereum Python Client. Already in that early phase, we anticipated that scaling would become a major challenge for blockchain technology. We took a deep-dive into scaling solutions for the Ethereum network and were commissioned to develop the open source payment channel solution Raiden Network.

Our Journey

With the in-depth blockchain expertise gained from our early long-term projects, we were able to establish ourselves as a crypto-focused development studio and consulting firm. We are commissioned by public bodies, supranational organizations, open source software foundations, and other clients. We provide development, consulting, marketing and communications, and community building work for various projects in the field of blockchain, Ethereum & Web3 infrastructure and applications.

Furthermore, we are involved in active research projects eligible for research allowance from the Federal Republic of Germany for our threshold-encryption research. Lastly, we are also a member of iBlockchain, a public research venture investigating the use of blockchains in industrial contexts.

Our Team

We have grown as a team from around 10 to 30+ ‘brainies’. Our expertise ranges from Smart Contract development and Web3 Full Stack development, to finance, accounting, legal, (international) HR management, to research, community building and business development.

Our Future

For the upcoming year 2023, we are proud to announce that we extend our activities to become a venture builder and professional services boutique. Our goal is to help Web3 projects to build open, secure, and reliable infrastructure.

Our team of experts will provide a home for founders and their ventures, including funding, fundraising, marketing, legal, accounting, mentoring, community building, and more.

With our professional services boutique, we will provide to our clients, whether independent early stage or matured projects, strategy & business consulting, smart contract audits, and development support along with other offerings customized to the needs of Web3 projects.

“We are thrilled to be able to use our expertise in developing blockchain technology to help companies take advantage of this exciting new paradigm,” said Heiko Franßen (CEO), “our hope is that we can provide not just technical expertise but also strategic guidance on how best to structure your project while navigating through possible regulatory hurdles.”

Our Ventures

We want to be the home for Web3 talents. To achieve this mission, we are helping entrepreneurs to reduce the risks and increase their chances of success. Why?

Building a successful startup is hard, but building a Web3 venture is even harder.

Regulations are unclear, and the lack of Web3 knowledge are two among various uncertainties that increase the risk of failure. We have learned our lessons in the last 7 years. You don’t have to take all those risks.

When we decide to co-found with you, we offer you the following:

• Compensation: We’ll match your current salary.
• Validation: We’ll validate your customer-problem-solution set.
• Development: We’ll co-build a Minimum viable product around your vision.
• Funding: We’ll match make your venture with pre-seed funders.

Our Services

We want builders to benefit from our 20+ years of experience in deep tech and our 7+ years of expertise in building Web3 infrastructure, protocols, apps, sustainable business models, and vibrant open-source communities. We group our Services into 4 categories:

• Security: We assess your smart contract code to identify any security vulnerabilities.
• Strategy: We find the optimal architecture and product approach, without compromising on decentralization and openness.
• Business: We share our experience and approach to structuring sustainable Web3 initiatives.
• Support: We develop and maintain software, provide research, and train entrepreneurs.

Get in touch!

We’re excited to start this new adventure and help build (and invest in) the next wave of Web3 ventures. If this sounds like something you might be interested in, please contact us:

• If you want to launch a Web3 venture: ventures@brainbot.com.
• If you want secure smart contracts, seize Web3 opportunities, or need development support: services@brainbot.com.
• If you want to join our team: career@brainbot.com.

Follow our Medium profile to stay up to date with our publications!