Preparation Mistakes
Errors made before the actual code review begins.
Not reading the documentation first
Jumping straight into code without understanding intended behavior leads to false positives and missed business logic bugs.
Unclear scope definition
Starting without clear scope leads to wasted time on out-of-scope contracts or missing in-scope dependencies.
Skipping automated tool runs
Not running Slither, Mythril, or other tools because you think manual review is sufficient.
Not setting up the local environment
Reviewing code without being able to run tests or write PoCs limits vulnerability verification.
Underestimating audit time needed
Accepting tight deadlines leads to rushed reviews and missed vulnerabilities.
Technical Mistakes
Errors in vulnerability identification and analysis.
Focusing only on code, not economics
Missing economic exploits because you only look for code bugs, not incentive manipulation.
Missing cross-contract reentrancy
Only checking for single-contract reentrancy when the protocol has multiple interacting contracts.
Ignoring external dependencies
Not reviewing how the contract interacts with external protocols like Uniswap, Aave, or Chainlink.
Not testing edge cases
Only testing happy path scenarios without considering zero values, max values, or empty arrays.
Misunderstanding protocol assumptions
Making incorrect assumptions about how the protocol should work without verifying with the team.
Missing read-only reentrancy
Not considering that view functions can return stale data during reentrancy.
Analysis Mistakes
Errors in vulnerability assessment and severity rating.
Incorrect severity assessment
Rating findings too high or too low damages credibility and prioritization.
Not writing proof of concept
Reporting theoretical vulnerabilities without proving they're exploitable.
Missing the root cause
Reporting symptoms rather than underlying vulnerability leads to incomplete fixes.
Duplicate findings from different angles
Reporting the same underlying issue multiple times as separate findings.
Missing attack prerequisites
Not clearly stating what conditions must exist for the attack to succeed.
Ignoring gas costs in attack profitability
Reporting attacks that are unprofitable after gas costs are considered.
Report Writing Mistakes
Errors in documenting and communicating findings.
Unclear vulnerability descriptions
Writing descriptions that only make sense to you, not the development team.
Missing code references
Not including specific line numbers and file paths for vulnerable code.
Vague recommendations
Suggesting fixes like 'add validation' without specifying what validation.
Not explaining impact clearly
Technical description without business impact leaves team unsure how to prioritize.
Forgetting to verify fixes
Not reviewing the fixes implemented for your findings.
Poor report organization
Dumping findings without logical organization or executive summary.
Process Mistakes
Workflow and professional conduct errors.
Working in isolation without team discussion
Not discussing potential findings with other auditors leads to missed insights.
Not tracking time per area
Spending too much time on one area while neglecting others.
Disclosing vulnerabilities inappropriately
Sharing findings publicly before the team has patched.
Not maintaining finding database
Each audit starts from scratch without use patterns from past audits.
Skipping the retest phase
Assuming fixes are correct without verification.
Ignoring test coverage gaps
Not reviewing what tests exist and what code paths remain untested.
Missing cross-protocol interactions
Auditing in isolation without considering how other protocols might interact.
Not tracking previous audits
Failing to review findings from previous audits of the same protocol.
Key Recommendations
Keep a checklist of common vulnerabilities and check each one explicitly. Do not rely on memory.
Take breaks. Auditor fatigue causes missed findings. Fresh eyes catch more bugs.
Build relationships with protocol teams. Good communication improves audit quality for everyone.
Study every post-mortem. When a protocol gets exploited, understand exactly what the auditors missed.
Contribute to open-source security tools. Building tools deepens your understanding of vulnerability patterns.