Solidity bug slips through for Hegic - no automated tests

[abcoathup]

Hi @miohtama,

Thanks for sharing your thoughts.

This is the OpenZeppelin recommended checklist to follow before an audit:

Follow this quality checklist before an audit - OpenZeppelin blog

I recommend everyone tests like a rockstar:

Test smart contracts like a rockstar

One does not simply test your dapp. Among many other things while developing a decentralized application, testing it is something you always need to do. What most people still don’t do is automate those tests, which leads to a huge loss of time and drains the energy to code. Automated tests have been around for a while and they have been gaining lots of traction in the last decade. Whilst blockchain and smart contract development are fairly new, we can still automate tests for these. We can, s…

One final point, is that Trail of Bits did a 3 day security assessment which is not the same as an audit.

There is also a list of post-mortems:

List of Ethereum Smart Contracts Post-Mortems

Note: Also check our Compiled List of Solidity Vulnerabilities. When things go wrong with the development, testing and auditing processes, vulnerable contracts are deployed to mainnet and go into production. These vulnerabilities are then either found by the good hackers and the project is patched, or they are exploited by the bad hackers and the project crashes. Sometimes weird things happen, when the definitions of good, bad, and crash are not very clear. But this is how we learn. Things …