Developers From Prominent Web3 Security Firms Collaborate On Proposal To Make Smart Contract Audit Reports Easily Accessible On-chain<\/p>\n
Ethereum developers have proposed a new smart contract standard intended to help users look up smart contract audits for DeFi protocols.<\/p>\n
Devs have been spiritedly debating ERC-7512<\/a> since it was first published to the Ethereum Magicians forum by Richard Meissner, the co-founder of Safe, on Sept. 5. Developers representing OtterSec, ChainSecurity, OpenZeppelin, Ackee Blockchain, and Hats Finance also contributed to the proposal<\/a>.<\/p>\n \u201cThe proposal aims to create a standard for an on-chain representation of audit reports that can be parsed by contracts to extract relevant information about the audits, such as who performed the audits and what standards have been verified,\u201d the authors wrote. \u201cTo provide strong guarantees about security and allow better composability, it is important that it is possible to verify on-chain that a contract has been audited.\u201d<\/p>\n While the intent of the proposal has drawn broad support from the community, developers are discussing the finer points of how to implement the standard.<\/p>\n \u201cThe idea of having on-chain audits is useful,\u201d replied<\/a> Dexara, the founder of Callisto Network. \u201cHowever, the implementation proposed in this ERC is overcomplicated significantly.\u201d<\/p>\n Dexara and others suggest utilizing a registry to organize audits in the form of non-transferable Soulbound Tokens<\/a> as an alternative to developing a new Ethereum standard. Meissner responded that the proposed ERC could be used in the context of a registry, but warned that solely relying on a registry offers \u201ca very centralized approach.\u201d<\/p>\n \u201cThis ERC focuses on standardizing what auditors should sign, rather than defining the registry,\u201d added<\/a> Shay Zluf. \u201cThe goal is to ensure consistent verification across the ecosystem.\u201d<\/p>\n Meissner also noted that while security audits are useful, they do not guarantee that a protocol\u2019s code is impenetrable.<\/p>\n