๐ Testing & Auditing: Quality Assurance
Discover how to test contracts and prepare for audits
Protect your dApp from common vulnerabilities
Your Progress
0 / 5 completed๐ฌ Testing & Auditing
Code is guilty until proven secure. Even with secure patterns, bugs slip through. That's why production DeFi uses a 4-layer testing pyramid: unit tests (70-80% coverage), integration tests (multi-contract flows), fuzz testing (random inputs find edge cases), and formal verification (mathematical proofs). Then comes professional auditingโexternal security firms (Trail of Bits, OpenZeppelin, Certora) spend 2-4 weeks trying to break your code. Top protocols pay $50k-200k per audit and run 2-3 audits from different firms. Finally, bug bounties ($10k-$1M+ rewards) incentivize whitehats to find bugs before blackhats. This section covers testing frameworks, audit checklists, and how to prepare for professional security reviews.
๐ฎ Interactive: Testing Pyramid
Explore the 4 layers of testing. Each layer catches different bug types with increasing thoroughness.
Unit Tests
Test individual functions in isolation
// Hardhat test example
const { expect } = require("chai");
describe("Token", function() {
let token, owner, addr1;
beforeEach(async function() {
[owner, addr1] = await ethers.getSigners();
const Token = await ethers.getContractFactory("Token");
token = await Token.deploy();
});
it("Should transfer tokens correctly", async function() {
await token.transfer(addr1.address, 100);
expect(await token.balanceOf(addr1.address)).to.equal(100);
});
it("Should revert on insufficient balance", async function() {
await expect(
token.connect(addr1).transfer(owner.address, 1)
).to.be.revertedWith("Insufficient balance");
});
it("Should emit Transfer event", async function() {
await expect(token.transfer(addr1.address, 100))
.to.emit(token, "Transfer")
.withArgs(owner.address, addr1.address, 100);
});
});- โข Fast feedback
- โข Catch basic bugs early
- โข CI/CD integration
- โข Free to run
- โข Miss integration bugs
- โข Don't test unexpected inputs
- โข Limited to known scenarios
๐ฎ Interactive: Audit Checklist
Click each category to expand the audit checklist. These are questions auditors ask when reviewing your code.
๐ข Professional Audit Firms
Top-tier firm, 2-4 week audits, $100k-200k. Audited Uniswap, Compound, Maker.
Industry standard, maintains OZ Contracts. $50k-150k, 2-3 weeks.
Formal verification specialists. Prover tool + manual review. $80k-200k.
Part of Consensys ecosystem. MythX automated tools + manual. $60k-150k.