Auditing a diff: rebuild it locally, note what you do not understand, then ask what it broke
We started the Mento V3 contest on Cantina with only 10 days left, but let's see what 0xfirefist can do.
Lesson Summary:
- When auditing diffs, close both repos, copy the contracts folder of the fork and replace the original folder to see the diff;
- When you see a change, get the context there and then. It is wasteful to spend a long time learning something you may not need;
- When you see a diff and have no idea what's the idea behind the change, take a note and then continue. Gathering notes and then reviewing them all at once could improve the efficiency as you will be able to go through all the notes one by one later, and understand other notes along the way;
- After understanding the change/diff, try to think of scenarios where it breaks something.
- Basic Flow: open changes --> go through every modified contract, alphabetically, see the changes, take notes of what you don't understand. Then, after taking all notes, if you don't understand some, go to the old implementation, see where the old for example variable was used, go to the next implementation, see where the change is used and understand if the change is well implemented;
- Check if all the variables are set correct in the new SystemParams contract. They've deleted them from Constants.sol and moved to SystemParams.sol;
- See the change, understand it, then try with the "Okay, but did this change break anything?" mindset;
- Go through all the changes, find the important ones.