BiasedMerc

Smart Contract Auditor - Competing in Competitive Audits

[BiasedMerc @BiasedMerc]

4th place finish on my 2nd ever contest! Mainly luck because no one else looked at emits, but I'll take it 😅

[SHERLOCK @sherlockdefi]

@cergyk1337 @0xSimao 🏆 @ZivoeFinance Audit Contest Results 🏆

4. @BiasedMerc - $2,512.23
5. @IronsideSec - $1,909.91
6. @armormadeofwoe - $1,755.64
7. SilverChariot - $1,346.95
8. 0xpiken - $1,341.16
9. @drynooo - $1,310.51
10. AllTooWell - $1,094.13

[BiasedMerc @BiasedMerc]

@TheOmniLiberal @dmtrltvn Definitely a good convo if it happens

[BiasedMerc @BiasedMerc]

@pathofexile bro what

[Free Pertsev & Storm @FreeAlexeyRoman]

Thank you to anonymous donor 0x5cB...52A49 for contributing 25 ETH to Alexey's legal defense on Juicebox.

With ~ 53 ETH ($140k) raised so far, your generosity brings us closer to our goal of 750k-1M needed to fund Alexey's appeal.

Open source is not a crime. Free Alexey.

[BiasedMerc @BiasedMerc]

@Xc1008Cui We tanking our accuracy ratio with this one 🔥

[BiasedMerc @BiasedMerc]

@chrisdior777 Great advice! Do you know a good source to find interesting articles related to Web3 security/ auditing? I love reading articles but find it hard to find new ones consistently

[BiasedMerc @BiasedMerc]

@jack__sanford Definitely 4, so I can learn how @xiaoming9090 is so good at math 😂

[BiasedMerc @BiasedMerc]

@ilchovski98 Did not expect Cantina to be beating Sherlock 👀

[Alex @__alexxander_]

SR: "Man, I wonder why escalations / pjqa take so long."

Also SR:

[BiasedMerc @BiasedMerc]

@_sammytm @0xjuaan @jack__sanford Very true, that's why I am always worried to ask questions about specific part of the code where I think there might be a bug :/

[BiasedMerc @BiasedMerc]

Great reply. One aspect I wanted to ask about is that for a newcomer into the space like me, the escalation system for Sherlock seems more inviting. It is open to anyone to be able to escalate their own issues, even if they do not have any special access like is needed in Code4rena to view findings before the audit is over.

I would be curious to see if this has an effect between the two platforms on the percentage of reports that are correctly resolved to be marked as valid, where they have been initially incorrectly marked as invalid due to automated bot sorting or a judging mistake.

In Sherlock, anyone can view all issues during the escalation period, so Wardens can check their own reports and ensure they have been correctly duplicated with other valid findings. In case their issue was missed, they can point it out. In Code4rena, the average auditor doesn’t have this privilege due to the required role access, meaning some valid findings that were incorrectly invalidated may never be validated, which can discourage people from participating if they feel they may not be rewarded for their valid findings in such cases.

[BiasedMerc @BiasedMerc]

@czar102 FACTS! You need time to recover and consolidate your learnings once the day is over.

[BiasedMerc @BiasedMerc]

@0xjuaan @RareSkills_io Goodluck and can't wait to hear about some of the ZK knowledge you will learn!

[BiasedMerc @BiasedMerc]

I think saying that “he probably won’t” show up is not fair to be used in this scenario. In audits, there is a clear financial incentive to show up, find bugs, and get paid, even without the LSW pay (which would lead to a 1/3 bigger reward pool for findings).

Yes, LSW pay guarantees that a LSW will be present, but without it, would those auditors not be competing in audits?

For the Zivoe contest, the total rewards were 80,000 USDC; however, the LSW pay was 24,500 while the rewards for findings were 47,500. I strongly believe if the findings rewards were 72,000, it would have led to more top auditors competing, rather than only heavily incentivizing one LSW to compete.

However, I do agree that it does guarantee a more even distribution of top auditors across Sherlock audits, especially for low total reward audits.

[BiasedMerc @BiasedMerc]

I do think the LSW model is interesting and something to aspire to (even though a small minority will ever reach it), but I do agree that it likely has no real impact on the outcome.

I can imagine that currently, the LSWs are much less likely to compete where they are not the LSW for that specific contest. (I mean, they get 1/3 of the total prize pot for contests where they are LSWs, so why would they waste their time if they are not getting the fixed pay?)

However, if there were no LSW pay, then the pot would be bigger, and the top Watsons (currently LSWs) would participate anyway and get higher pay for their found issues.

I do think the C4 new hunter and gatherer bonuses are fairer, as in theory, anyone could get the bonus if they have a top-level performance in a contest. There is no need to reach the top leaderboard to qualify for this bonus.

While LSWs get a large percentage of the pot, they need to be at the top of the leaderboard. This disincentivizes others from competing, as why would any top-level Watson compete in a contest where the prize pot has been reduced by 1/3 to give another Watson fixed pay? This can turn some ‘competitive’ audits into basically solo audits, where others can compete to get severely underpaid for their findings.

[BiasedMerc @BiasedMerc]

@MartinMarchev Thank you, more to come soon 🙏

[BiasedMerc @BiasedMerc]

4th place finish on my 2nd ever contest! Mainly luck because no one else looked at emits, but I'll take it 😅

[SHERLOCK @sherlockdefi]

@cergyk1337 @0xSimao 🏆 @ZivoeFinance Audit Contest Results 🏆

4. @BiasedMerc - $2,512.23
5. @IronsideSec - $1,909.91
6. @armormadeofwoe - $1,755.64
7. SilverChariot - $1,346.95
8. 0xpiken - $1,341.16
9. @drynooo - $1,310.51
10. AllTooWell - $1,094.13

[BiasedMerc @BiasedMerc]

@0xOwenThurm All these influencers selling out for a bag 😭🤣

[BiasedMerc @BiasedMerc]

@MartinMarchev @ilchovski98 @audit Same here, I always write a quick draft of any issues I find, then go through them later, polish them up and add POCs.

[BiasedMerc @BiasedMerc]

@high_byte In any industry you can find terrible companies that will overwork you like crazy, whilst others will provide great benefits and have a good environment.

I've experienced both and know the 1st option will spill into personal life and make you miserable...

[BiasedMerc @BiasedMerc]

@0xSimao @sherlockdefi Nice work! Reading through your findings now, and I see you had some tough judging discussions💪

[BiasedMerc @BiasedMerc]

@MartinMarchev @bytes032 Damn, that's really cool!