Frequently Asked Questions

Clear

Search by topics

Infrastructure

Ecosystem

Security R&D

Arbitrary Execution

Blockchain Security

Web3 SDLC

Security Monitoring

DeFi

Smart Contract Audit

Thank you! Your submission has been received!

Oops! Something went wrong while submitting the form.

What is a smart contract audit?

A smart contract audit is a review of the protocol’s codebase to ensure that it’s secure, reliable, and functions as intended. During a smart contract audit, security experts evaluate the code and test it to identify potential vulnerabilities or issues. A smart contract audit also ensures that the contract adheres to best practices for development and follows industry standards.

Smart Contract Audit

Does my DeFi protocol need an audit?

DeFi protocols need a thorough security audit before they are deployed on the blockchain. DeFi protocols often handle sensitive data or large sums of money, so it's important for them to be thoroughly tested and secure. A security audit can help ensure a DeFi protocol is reliable and trustworthy, and can give users confidence in the protocol's security and stability.

DeFi

What is smart contract monitoring?

Smart contract monitoring is the automated process of checking new blockchain transactions for any concerning characteristics and sending notifications to parties that have subscribed to that monitoring. Concerning transactions characteristics may include a value that exceeds a certain threshold, internal transactions that involve sanctioned smart contracts, or any other criteria you specify.

Security Monitoring

What is the Web3 SDLC?

The Web3 SDLC is a security framework that enables Web3 developers to incorporate security into every step of their development life cycle.

Web3 SDLC

What is blockchain security?

Blockchain security is developing blockchain applications in a way that avoids known vulnerabilities with the aim of protecting blockchain assets from hacks or exploits.

Blockchain Security

What sets you apart from other security companies?

At Arbitrary Execution, we take pride in everything we do, and that begins with a deep understanding of the Web2 and Web3 technologies our clients use. This uniquely positions us to evaluate both the on-chain and off-chain components of any project. Because our engineers have a background in offensive security, we think like attackers and approach our work with the hacker’s mindset. When you engage us to be your security partner, you will feel like you are a part of the process, whether for development work or for audits.

Arbitrary Execution

Are you able to work with new platforms or unfamiliar technology?

Yes. It is in our team’s DNA to constantly learn and understand new technologies. Our experience with a wide range of platforms and protocols gives us a solid head start in evaluating new technologies we haven’t worked with before. We are always excited to add new systems to our skill set.

Security R&D

Why are ecosystem audits important?

Web3 ecosystems can have a tremendous amount of complexity in their individual components and in the interactions between components. As the size of an ecosystem increases, the complexity increases along with it. The security of a system is only as strong as its weakest link, so a hidden vulnerability anywhere within the ecosystem can put the entire ecosystem at risk.

Ecosystem

What experience does Arbitrary Execution have in Web3 infrastructure?

As a research and engineering firm, Arbitrary Execution’s experience covers a wide range of on-chain and off-chain Web3 components, including many core infrastructure elements. Our work has involved EVM node internals, decentralized storage systems, communication systems, bridges, rollup-processors, and wallets, to name a few.

Infrastructure

When should I audit my DeFi protocol?

You should audit your DeFi protocol before launching on the blockchain, when making significant changes, before implementing new features or functionality, and as part of a regular security review. Check out our blog to learn more about When to Schedule Your Smart Contract Audit.

DeFi

Do I need a smart contract audit?

Web3 protocols need a thorough smart contract audit before they are deployed on the blockchain. Smart contracts often handle sensitive data or large sums of money, so it’s important for them to be thoroughly tested and secure. A smart contract audit can help ensure a protocol is reliable and trustworthy, and can give users confidence in the protocol's security and stability.

Smart Contract Audit

What notification channel options are available?

Email, chat messages in applications like Discord and Telegram, Twitter tweets, dashboards like Splunk or Datadog, and custom interactions with HTTP APIs that you specify.

Security Monitoring

Why does Web3 need established security standards?

In Web3, all it takes is one damaging hack to drain a project’s funds or damage its reputation. Without established security standards that the community has vetted and proven through repeated use, projects are left to cobble together a mishmash of security principles from different sources on the web, some of which are out of date, others which are woefully incomplete. The best defense can come from an established, widely accepted security standard.

Web3 SDLC

Why is blockchain security important?

Hackers and scammers have exploited vulnerabilities in blockchain projects, leading to billions of dollars’ worth of losses in recent years. As blockchain technology moves beyond its use primarily in the financial sector into logistics, identity management, IoT, and healthcare, the effects of lax security may soon also affect personal health and safety, so the stakes are high.

Blockchain Security

How does your traditional security background set you up to do well in the web3 space?

Having years of experience in traditional security has given our security researchers an eye and intuition for the types of scenarios that can lead to vulnerabilities. Working in the field of security research develops the discipline to explore every possibility and leave no stone unturned. It is exactly these qualities that are needed when analyzing potential threats and vulnerabilities in Web3 projects.

Arbitrary Execution

At what point in my project’s life cycle would I benefit from R&D services?

Research and development services are useful at every stage of your project’s life cycle. During the design phase, Arbitrary Execution can assist your research efforts by helping you build effective security concepts into your project’s design. During development, AE’s team can assist with the buildout or provide code audits. During deployment, AE can ensure a safe and seamless rollout and help automate the deployment pipeline. Once in production, AE can help defend your work by implementing monitoring solutions and analytics.

Security R&D

How can Arbitrary Execution help with an entire ecosystem? Don’t auditors just verify smart contracts?

Smart contract audits are probably what Web3 security researchers are best known for, but at Arbitrary Execution, we have expertise beyond smart contract audits. We are a team of security researchers and engineers with the skills to break (and build!) critical components in a blockchain ecosystem. Whether it’s development work, audits of on-chain or off-chain components, or even building developer tooling, there are plenty of areas in a blockchain ecosystem where we can help.

Ecosystem

We don’t develop Web3 infrastructure—we just use it. Would infrastructure security services still benefit us?

The security of a project includes the security strengths and weaknesses of its dependencies, so projects that rely upon existing Web3 infrastructure components should consider the security of those components. Arbitrary Execution can provide security assessments of the key technology dependencies within your project to help you decide which dependencies are secure and which should be replaced. Our broad awareness of Web3 infrastructure options enables us to help you choose the most secure products upon which to build your project.

Infrastructure

When should I get a smart contract audit?

You should get a smart contract audit before launching a new contract on the blockchain, when making significant changes to an existing contract, before implementing new features or functionality, and as part of a regular security review. Check out our blog to learn more about When To schedule Your Smart Contract Audit.

Smart Contract Audit

Do I need to monitor my smart contracts?

Yes, unless you would prefer to find out about anomalous activity from Twitter.

Security Monitoring

Why is it important to integrate security throughout the development life cycle?

When security is treated as an afterthought or is not considered at all during development, the amount of work and expense that will be necessary to incorporate security later will be much higher. When security is integrated from the beginning of a project, the value of your professional security audit will be greatly enhanced and third-party auditors will be able to focus on the more complex areas of your project.

Web3 SDLC

How is blockchain security different from Web2 security?

The field of blockchain security incorporates many of the existing security concerns of Web2 security, but the emerging technologies of Web3 bring new challenges not seen before in Web2. One of the main differences in blockchain security stems from the extensive use of smart contracts, which are the immutable programs that live on the blockchain that control the interactions between users and the blockchain.

Blockchain Security

How can I stay up to date with official Arbitrary Execution news?

Follow current events and Arbitrary Execution news on our Twitter and LinkedIn pages, and on our Blog.

Arbitrary Execution

What will the relationship between my team and Arbitrary Execution look like?

Arbitrary Execution can provide you with the ultimate flexibility in the working relationship by tailoring it to your specific wants and needs. On one end of the spectrum, we can equip you with the tools and resources you need to do the work yourself. On the other end of the spectrum, we can provide you with a fully turnkey solution by doing all the work for you. In the middle, we can partner with you as an extension of your own research and development team to do the work in tandem.

Security R&D

Does Arbitrary Execution have the skills necessary to understand an entire ecosystem?

Before bringing their security expertise to the world of Web3, the team at Arbitrary Execution had many years of experience working in the traditional security industry, where a practitioner’s focus must be both broad and deep. This ability to be proficient in a wide range of skills and abilities has carried over into our approach to securing Web3, where we understand the full range of on-chain and off-chain components, from the nuances of EVM internals to decentralized storage solutions to smart contract systems. We are uniquely prepared to secure all components in a blockchain ecosystem.

Ecosystem

Should we use existing Web3 infrastructure options or build our own?

The complexity involved in building core infrastructure usually makes it practical to make use of existing options instead of rolling your own. In cases where there are mature, widely accepted options available, you will probably be safest using these options. When limited options exist, or when existing options do not offer the features your project needs, you may need to build the infrastructure component yourself. Arbitrary Execution can help you decide which path to take, and can help you design and build a Web3 infrastructure component should the need arise.

Infrastructure

How much does a smart contract audit cost?

The cost of a smart contract audit can vary widely, depending on several factors including the complexity of the contract, the experience and expertise of the auditor, and the desired turnaround time. Some companies charge by the hour, while others offer fixed-rate packages. Generally, you can expect to pay several thousand dollars for a comprehensive smart contract audit. It's important to choose a reputable and experienced auditor to ensure that you are getting a high-quality audit.

Smart Contract Audit

What should I monitor?

Our monitoring experts will meet with you to learn about your project, review your documentation, code, and audit reports, and create a set of recommendations for you to consider. If you already have some thoughts on what you would like to monitor, our representatives will incorporate that into your project's monitoring plan.

Security Monitoring

How can I learn more about the Web3 SDLC?

Visit our series of blog posts on the Web3 SDLC.

Web3 SDLC

Where can I learn more about blockchain security?

Arbitrary Execution frequently posts information on a wide range of blockchain security topics in its blog. We have also helped author the Web3 SDLC which is a Web3 security framework for secure project development. AE also offers blockchain security training courses on its training page.

Blockchain Security

How can I reach out to Arbitrary Execution for support?

For any questions or support needs, please feel free to contact us on our website’s Contact page.

Arbitrary Execution

Can Arbitrary Execution help developers in my ecosystem?

Yes. As other Web3 projects seek to build on top of your ecosystem, it is important to maintain the security of the entire ecosystem by ensuring the security of their work. Arbitrary Execution can serve as a trusted security partner that engages with new ecosystem partners to ensure that security is factored into their design from inception to completion. Accelerators and incubators can leverage our services to ensure that all new projects meet the required level of security.

Ecosystem

How long does a smart contract audit take?

Depending on the size of your smart contract code, plan to add around 2 to 8 weeks at the end of your release schedule to account for auditing. Expect to schedule the audit several months in advance of your code freeze date.

Smart Contract Audit

Do I need to set up any infrastructure for monitoring?

Monitoring is typically performed in the cloud by servers that are receiving blocks as soon as they are mined or validated, although you may choose to keep your monitoring resources on your own server (or other hardware). The amount of infrastructure you need to set up is as much or as little as you would like.

Security Monitoring

How can I start using the Web3 SDLC in my development life cycle?

In addition to the Web3 SDLC’s descriptive content, the SDLC also has a prescriptive component in its [Security Maturity Model (SMM)](add hyperlink here) that projects can use to receive detailed security guidance and assess their security maturity.

Web3 SDLC

How do I prepare for a smart contract audit?

To prepare for a smart contract audit, you should identify the scope of the audit and set clear goals for the engagement. These goals can contain any specific questions and concerns you have. You should also ensure documentation is up to date, including code comments and written documentation

Smart Contract Audit

What monitoring platforms are available?

There are several monitoring platform vendors who provide various tiers of service. Some provide a free tier with limits to the amount of computation available or the number of features available.

Security Monitoring

How much do monitoring platforms cost?

It varies based on your needs. If you need a lot of computation and some of the advanced features, it may be hundreds or thousands of dollars per month. Our security experts will help you determine the most economical way for you to achieve your monitoring goals without compromising your coverage.

Security Monitoring

What if I want to do monitoring on my own?

Our security experts can provide you with the resources you need to get started, be it walkthroughs, example repositories, or other reference material. We can also arrange for several recorded video ask me anything (AMA) sessions with our experts to answer your questions and help troubleshoot any issues or blockers that are in your way.

Security Monitoring

Does monitoring work on the mempool?

Most monitoring platforms available process transactions that have already been included in recent blocks. That is to say that the effects of those transactions are already part of the blockchain. If you desire to monitor pending transactions in the mempool, we can create a custom solution that integrates mempool data providers into your monitoring suite.

Security Monitoring

What should I do after an audit?

The need for security doesn’t disappear after an audit. In addition to reviewing new code changes, it’s important to continuously monitor the health and usage of your DeFi protocol. You should develop and implement a plan for monitoring, detection, and response. Arbitrary Execution is equipped to help you at any stage of the secure development life cycle.

DeFi

Smart Contract Audit

Have additional questions?