Frequently Asked Questions

What is a smart contract audit?

A smart contract audit is a review of the protocol’s codebase to ensure that it’s secure, reliable, and functions as intended. During a smart contract audit, security experts evaluate the code and test it to identify potential vulnerabilities or issues. A smart contract audit also ensures that the contract adheres to best practices for development and follows industry standards.

Smart Contract Audit

Does my DeFi protocol need an audit?

DeFi protocols need a thorough security audit before they are deployed on the blockchain. DeFi protocols often handle sensitive data or large sums of money, so it's important for them to be thoroughly tested and secure. A security audit can help ensure a DeFi protocol is reliable and trustworthy, and can give users confidence in the protocol's security and stability.

DeFi

Are you able to work with new platforms or unfamiliar technology?

Yes. It is in our team’s DNA to constantly learn and understand new technologies. Our experience with a wide range of platforms and protocols gives us a solid head start in evaluating new technologies we haven’t worked with before. We are always excited to add new systems to our skill set.

Security R&D

What is smart contract monitoring?

Smart contract monitoring is the automated process of checking new blockchain transactions for any concerning characteristics and sending notifications to parties that have subscribed to that monitoring. Concerning transactions characteristics may include a value that exceeds a certain threshold, internal transactions that involve sanctioned smart contracts, or any other criteria you specify.

Security Monitoring

What sets you apart from other security companies?

At Arbitrary Execution, we take pride in everything we do, and that begins with a deep understanding of the Web2 and Web3 technologies our clients use. This uniquely positions us to evaluate both the on-chain and off-chain components of any project. Because our engineers have a background in offensive security, we think like attackers and approach our work with the hacker’s mindset. When you engage us to be your security partner, you will feel like you are a part of the process, whether for development work or for audits.

Arbitrary Execution

Why are ecosystem audits important?

Web3 ecosystems can have a tremendous amount of complexity in their individual components and in the interactions between components. As the size of an ecosystem increases, the complexity increases along with it. The security of a system is only as strong as its weakest link, so a hidden vulnerability anywhere within the ecosystem can put the entire ecosystem at risk.

Ecosystem

What is the Web3 SDLC?

The Web3 SDLC is a security framework that enables Web3 developers to incorporate security into every step of their development life cycle.

Web3 SDLC

What is blockchain security?

Blockchain security is developing blockchain applications in a way that avoids known vulnerabilities with the aim of protecting blockchain assets from hacks or exploits.

Blockchain Security

What experience does Arbitrary Execution have in Web3 infrastructure?

As a research and engineering firm, Arbitrary Execution’s experience covers a wide range of on-chain and off-chain Web3 components, including many core infrastructure elements. Our work has involved EVM node internals, decentralized storage systems, communication systems, bridges, rollup-processors, and wallets, to name a few.

Infrastructure

Why should I learn smart contract security?

If you are a Web3 developer, knowing how to incorporate security into your code is important because it helps you receive the greatest value from any professional security audits your code receives. When security is designed into a system from the beginning, audits can be completed in a shorter amount of time, costing less overall, and the professional auditors will be able to focus on the more nuanced vulnerabilities that may exist. If you are interested in learning smart contract security to pursue a career as a smart contract auditor, Web3 is an exciting field to work in and the demand for smart contract auditors is currently high and expected to increase.

Training

How is a security retainer different from a smart contract audit?

Smart contract audits are timeboxed engagements (usually 1-4 weeks) to ensure that code is secure, reliable, and functions as intended. They are a review of a snapshot of the codebase. A retainer is a longer-term engagement (3-6+ months) where a project is continuously reviewed and tested.

Security Retainer

How does your traditional security background set you up to do well in the web3 space?

Having years of experience in traditional security has given our security researchers an eye and intuition for the types of scenarios that can lead to vulnerabilities. Working in the field of security research develops the discipline to explore every possibility and leave no stone unturned. It is exactly these qualities that are needed when analyzing potential threats and vulnerabilities in Web3 projects.

Arbitrary Execution

What notification channel options are available?

Email, chat messages in applications like Discord and Telegram, Twitter tweets, dashboards like Splunk or Datadog, and custom interactions with HTTP APIs that you specify.

Security Monitoring

When should I audit my DeFi protocol?

You should audit your DeFi protocol before launching on the blockchain, when making significant changes, before implementing new features or functionality, and as part of a regular security review. Check out our blog to learn more about When to Schedule Your Smart Contract Audit.

DeFi

Do I need a smart contract audit?

Web3 protocols need a thorough smart contract audit before they are deployed on the blockchain. Smart contracts often handle sensitive data or large sums of money, so it’s important for them to be thoroughly tested and secure. A smart contract audit can help ensure a protocol is reliable and trustworthy, and can give users confidence in the protocol's security and stability.

Smart Contract Audit

Why is blockchain security important?

Hackers and scammers have exploited vulnerabilities in blockchain projects, leading to billions of dollars’ worth of losses in recent years. As blockchain technology moves beyond its use primarily in the financial sector into logistics, identity management, IoT, and healthcare, the effects of lax security may soon also affect personal health and safety, so the stakes are high.

Blockchain Security

How can Arbitrary Execution help with an entire ecosystem? Don’t auditors just verify smart contracts?

Smart contract audits are probably what Web3 security researchers are best known for, but at Arbitrary Execution, we have expertise beyond smart contract audits. We are a team of security researchers and engineers with the skills to break (and build!) critical components in a blockchain ecosystem. Whether it’s development work, audits of on-chain or off-chain components, or even building developer tooling, there are plenty of areas in a blockchain ecosystem where we can help.

Ecosystem

We don’t develop Web3 infrastructure—we just use it. Would infrastructure security services still benefit us?

The security of a project includes the security strengths and weaknesses of its dependencies, so projects that rely upon existing Web3 infrastructure components should consider the security of those components. Arbitrary Execution can provide security assessments of the key technology dependencies within your project to help you decide which dependencies are secure and which should be replaced. Our broad awareness of Web3 infrastructure options enables us to help you choose the most secure products upon which to build your project.

Infrastructure

Why does Web3 need established security standards?

In Web3, all it takes is one damaging hack to drain a project’s funds or damage its reputation. Without established security standards that the community has vetted and proven through repeated use, projects are left to cobble together a mishmash of security principles from different sources on the web, some of which are out of date, others which are woefully incomplete. The best defense can come from an established, widely accepted security standard.

Web3 SDLC

At what point in my project’s life cycle would I benefit from R&D services?

Research and development services are useful at every stage of your project’s life cycle. During the design phase, Arbitrary Execution can assist your research efforts by helping you build effective security concepts into your project’s design. During development, AE’s team can assist with the buildout or provide code audits. During deployment, AE can ensure a safe and seamless rollout and help automate the deployment pipeline. Once in production, AE can help defend your work by implementing monitoring solutions and analytics.

Security R&D

Why should I take a security course from Arbitrary Execution?

Arbitrary Execution’s team of security researchers bring years of offensive security expertise, tactics, techniques, and a hacker’s mindset to help secure the crypto ecosystem. Before starting Arbitrary Execution, the team had a long history of experience in the traditional vulnerability research field. In the two years since the company’s inception, Arbitrary Execution has performed more than 40 audits of Web3 protocols and projects, as well as created tools that continuously monitor the blockchain for anomalous activity. Our courses are taught by real-world practitioners who spend their time outside of courses performing audits.

Training

Do I still need an audit if I have a security retainer?

Audits are still an important part of the Web3 development life cycle, and a retainer is not a replacement. However, having a security partner throughout your development process will produce cleaner, more secure code. This will save you time and money when during a comprehensive audit.

Security Retainer

Why is it important to integrate security throughout the development life cycle?

When security is treated as an afterthought or is not considered at all during development, the amount of work and expense that will be necessary to incorporate security later will be much higher. When security is integrated from the beginning of a project, the value of your professional security audit will be greatly enhanced and third-party auditors will be able to focus on the more complex areas of your project.

Web3 SDLC

Do I need to monitor my smart contracts?

Yes, unless you would prefer to find out about anomalous activity from Twitter.

Security Monitoring

How can I stay up to date with official Arbitrary Execution news?

Follow current events and Arbitrary Execution news on our Twitter and LinkedIn pages, and on our blog.

Arbitrary Execution

What will the relationship between my team and Arbitrary Execution look like?

Arbitrary Execution can provide you with the ultimate flexibility in the working relationship by tailoring it to your specific wants and needs. On one end of the spectrum, we can equip you with the tools and resources you need to do the work yourself. On the other end of the spectrum, we can provide you with a fully turnkey solution by doing all the work for you. In the middle, we can partner with you as an extension of your own research and development team to do the work in tandem.

Security R&D

Does Arbitrary Execution have the skills necessary to understand an entire ecosystem?

Before bringing their security expertise to the world of Web3, the team at Arbitrary Execution had many years of experience working in the traditional security industry, where a practitioner’s focus must be both broad and deep. This ability to be proficient in a wide range of skills and abilities has carried over into our approach to securing Web3, where we understand the full range of on-chain and off-chain components, from the nuances of EVM internals to decentralized storage solutions to smart contract systems. We are uniquely prepared to secure all components in a blockchain ecosystem.

Ecosystem

How is blockchain security different from Web2 security?

The field of blockchain security incorporates many of the existing security concerns of Web2 security, but the emerging technologies of Web3 bring new challenges not seen before in Web2. One of the main differences in blockchain security stems from the extensive use of smart contracts, which are the immutable programs that live on the blockchain that control the interactions between users and the blockchain.

Blockchain Security

When should I get a smart contract audit?

You should get a smart contract audit before launching a new contract on the blockchain, when making significant changes to an existing contract, before implementing new features or functionality, and as part of a regular security review. Check out our blog to learn more about When To Schedule Your Smart Contract Audit.

Smart Contract Audit

Should we use existing Web3 infrastructure options or build our own?

The complexity involved in building core infrastructure usually makes it practical to make use of existing options instead of rolling your own. In cases where there are mature, widely accepted options available, you will probably be safest using these options. When limited options exist, or when existing options do not offer the features your project needs, you may need to build the infrastructure component yourself. Arbitrary Execution can help you decide which path to take, and can help you design and build a Web3 infrastructure component should the need arise.

Infrastructure

What level of technical proficiency do I need to attend training?

To attend one of our training courses, you should have a basic understanding of blockchain technology and how it is used in the Ethereum EVM. You should also have the ability to read and understand code written in JavaScript or a similar high-level programming language. Familiarity with the Solidity programming language is helpful.

Training

When should I get a retainer?

Security retainers can have an impact at any stage of your project. The earlier you involve a partner in the process, the more options you will have for tasking.

Security Retainer

How much does a smart contract audit cost?

The cost of a smart contract audit can vary widely, depending on several factors including the complexity of the contract, the experience and expertise of the auditor, and the desired turnaround time. Some companies charge by the hour, while others offer fixed-rate packages. Generally, you can expect to pay several thousand dollars for a comprehensive smart contract audit. It's important to choose a reputable and experienced auditor to ensure that you are getting a high-quality audit.

Smart Contract Audit

How can I reach out to Arbitrary Execution for support?

For any questions or support needs, please feel free to contact us on our website’s Contact page.

Arbitrary Execution

How can I learn more about the Web3 SDLC?

Visit our series of blog posts on the Web3 SDLC.

Web3 SDLC

Can Arbitrary Execution help developers in my ecosystem?

Yes. As other Web3 projects seek to build on top of your ecosystem, it is important to maintain the security of the entire ecosystem by ensuring the security of their work. Arbitrary Execution can serve as a trusted security partner that engages with new ecosystem partners to ensure that security is factored into their design from inception to completion. Accelerators and incubators can leverage our services to ensure that all new projects meet the required level of security.

Ecosystem

Where can I learn more about blockchain security?

Arbitrary Execution frequently posts information on a wide range of blockchain security topics in our blog. We have also helped author the Web3 SDLC which is a Web3 security framework for secure project development. AE also offers blockchain security training courses on our training page.

Blockchain Security

What should I monitor?

Our monitoring experts will meet with you to learn about your project, review your documentation, code, and audit reports, and create a set of recommendations for you to consider. If you already have some thoughts on what you would like to monitor, our representatives will incorporate that into your project's monitoring plan.

Security Monitoring

I can't make any of your upcoming trainings, when are the next ones?

Check our Training Page frequently as we regularly add new training dates.

Training

How much does a retainer cost?

Like audits, the cost of a retainer can vary. Generally, the hourly rate for retainers is lower than a smart contract audit.

Security Retainer

How long does a smart contract audit take?

Depending on the size of your smart contract code, plan to add around 2 to 8 weeks at the end of your release schedule to account for auditing. Expect to schedule the audit several months in advance of your code freeze date.

Smart Contract Audit

Do I need to set up any infrastructure for monitoring?

Monitoring is typically performed in the cloud by servers that are receiving blocks as soon as they are mined or validated, although you may choose to keep your monitoring resources on your own server (or other hardware). The amount of infrastructure you need to set up is as much or as little as you would like.

Security Monitoring

How can I start using the Web3 SDLC in my development life cycle?

In addition to the Web3 SDLC’s descriptive content, the SDLC also has a prescriptive component in its Security Maturity Model (SMM) that projects can use to receive detailed security guidance and assess their security maturity.

Web3 SDLC

Do your training classes include live instruction?

Yes, all of our classes are live and instructor led. Some of our classes are offered online through video sharing platforms like Discord, while others are offered in person at select security conferences throughout the year.

Training

How long do retainers last?

Retainer durations can vary. We recommend starting with a duration of 4-6 months to allow our team to develop a deep understanding of your development process and project plans.

Security Retainer

How do I prepare for a smart contract audit?

To prepare for a smart contract audit, you should identify the scope of the audit and set clear goals for the engagement. These goals can contain any specific questions and concerns you have. You should also ensure documentation is up to date, including code comments and written documentation

Smart Contract Audit

What monitoring platforms are available?

There are several monitoring platform vendors who provide various tiers of service. Some provide a free tier with limits to the amount of computation available or the number of features available.

Security Monitoring

Do you offer custom training options?

Yes. If you are seeking customized training to fit a specific need for your company or to prepare for an upcoming project, contact us to see how we can tailor-make a program to fit your specific needs.

Training

How do I prepare for a security retainer?

We recommend reading through our Web3 SDLC and Security Maturity Model to understand where your project’s strengths and deficiencies are. Having an idea of your areas of concern can help direct our effort in the early stages of a retainer.

Security Retainer

How much do monitoring platforms cost?

It varies based on your needs. If you need a lot of computation and some of the advanced features, it may be hundreds or thousands of dollars per month. Our security experts will help you determine the most economical way for you to achieve your monitoring goals without compromising your coverage.

Security Monitoring

What if I want to do monitoring on my own?

Our security experts can provide you with the resources you need to get started, be it walkthroughs, example repositories, or other reference material. We can also arrange for several recorded video ask me anything (AMA) sessions with our experts to answer your questions and help troubleshoot any issues or blockers that are in your way.

Security Monitoring

Does monitoring work on the mempool?

Most monitoring platforms available process transactions that have already been included in recent blocks. That is to say that the effects of those transactions are already part of the blockchain. If you desire to monitor pending transactions in the mempool, we can create a custom solution that integrates mempool data providers into your monitoring suite.

Security Monitoring

What should I do after an audit?

The need for security doesn’t disappear after an audit. In addition to reviewing new code changes, it’s important to continuously monitor the health and usage of your DeFi protocol. You should develop and implement a plan for monitoring, detection, and response. Arbitrary Execution is equipped to help you at any stage of the secure development life cycle.

DeFi

Smart Contract Audit

Have additional questions?