Shipping unaudited: the cost of skipping the work

Graduate · enrolled learners

This lesson opens with Grim Finance, December 2021.

What happened

Grim Finance ran vaults on Fantom, and its deposit function made an external call to the token being deposited before it finished updating the vault's internal accounting, and it did not guard against reentrancy. An attacker supplied a malicious token whose code, when called during that deposit, called back into the deposit function again before the first call had recorded the deposit, so the attacker's share balance was credited repeatedly for the same funds. Looping this, they inflated their share of the vault far beyond what they had put in and withdrew about 30 million dollars. Reentrancy of this kind is one of the oldest and best-understood vulnerability classes in the field, with standard, well-known defenses, and it is precisely the kind of flaw a competent review or audit is built to catch. The contract was not defeated by a novel or subtle attack; it was defeated by a known pattern that the work of reviewing had not been done to find, so the bug shipped, and the exploit was the review the project never paid for, conducted by an adversary and billed at 30 million dollars.

The decision point

Skipping rigorous review and audit does not remove the cost of finding a contract's bugs; it defers that cost and enlarges it, because the bugs are found either by reviewers before deployment or by attackers after it, and the second is far more expensive. Grim Finance is the case: its deposit function had an unguarded reentrancy, one of the oldest and best-understood vulnerability classes, which a standard review is specifically built to catch, and because that review was not done, an attacker found the flaw instead and drained about 30 million dollars. This is the audit lesson stated plainly: review and audit are not a bureaucratic gate after building; they are the part of building where the well-known failure classes are hunted deliberately by someone whose job is to find them, and the reason they exist is that a builder cannot reliably find their own blind spots, especially in classes that are subtle to write correctly even when they are famous. So the discipline is to treat rigorous review and independent audit as part of shipping, not an optional extra, to recognize that a known vulnerability class shipped is not bad luck but skipped work, and to weigh the cost of the audit against the cost of the exploit it would have prevented, which is the true comparison. Grim Finance is what shipping unaudited buys: not saved time and money, but a review performed by an adversary, on their schedule, for their benefit, and billed at the full value of the contract.

Recorded loss

$30,000,000

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.