Security Audit Deliverables & Public Reports

At ExtBit LLC, our security practice focuses on manual Abstract Syntax Tree (AST) code analysis, mathematical invariant verification, and practical exploit proof-of-concept (PoC) development—never reliance on superficial automated linter output.

Below is a curated index of sample audit deliverables, DeFi protocol logic reviews, and vulnerability assessments demonstrating our reporting standards.

1🛡️ Smart Contract & DeFi Protocol Audits

1.1EVM Yield Farming Logic & Backdoor Assessment (PDF)

  • Scope: Multi-token yield farming logic & reward distribution contracts (Solidity ^0.6.12).
  • Key Vectors: Misused modifiers (updateReward, checkhalve), state-changing public initializers, LP supply manipulation, and stealth yield-rate backdoors.
  • Deliverable Format: Line-by-line AST review, code copy annotations, and attack surface conclusions.

1.2MasterChef LP Minting & Access Control Security Review (PDF)

  • Scope: MasterChef-style staking pools, custom BEP20 token minting, and yield governance logic.
  • Key Vectors: Unrestricted sage.mint() triggers via arbitrary LP token registration, privilege escalation in owner functions, and SafeBEP20 allowance bypasses.
  • Deliverable Format: Structural dependency mapping, threat scenario modeling, and code copy highlights.

2⚔️ Offensive Security & Exploit Teardowns

2.1Flash-Loan Oracle Liquidation Exploit Teardown (PDF)

  • Scope: AMM liquidity pool oracle pricing (IUniswapV2Pair) and flash-loan-collateralized lending protocols.
  • Key Vectors: Under-collateralized borrowing via oracle rate manipulation, cross-account liquidation accounting flaws (msg.sender vs user debt tracking), and external call execution traps.
  • Deliverable Format: Mathematical scenario proof, multi-contract Solidity exploit harness (bankrupt.sol), and Web3.js execution runner.

2.2Unprotected State Access Control Takeover (PDF)

  • Scope: Stateful EVM vault and wallet contracts (Solidity ^0.8.0).
  • Key Vectors: Unguarded public state setters (setOwner()), modifier bypasses, and immediate balance drain triggers.
  • Deliverable Format: CTF/Exploit walkthrough, browser-based Web3 execution script, and remediation recommendations.

3📋 Request a Custom Security Audit

Need an independent security review, AST code audit, or zero-trust architecture assessment before launching on mainnet?