Coinbase has unveiled a new tool that can automatically audit smart contracts built on Ethereum that use the Solidity programming language. <\/p>\n
Designed to be used by smart contract auditors, asset issuers, and other exchanges, the firm has plans to make the tool open source later this year <\/p>\n
In a June 23 post, Coinbase\u2019s principal blockchain security engineer Peter Kacherginsky announced the firm’s new security analysis tool dubbed \u201cSolidify\u201d, which was created to improve on the \u201ctime-intensive and error-prone\u201d process of manual smart contract analysis. <\/p>\n
The engineer noted that the exchange\u2019s token listing process requires extensive security reviews and \u201crisk mitigation recommendations\u201d for every smart contract to keep consumers safe. <\/p>\n
The firm required an analyzer that can work quickly, safely, and at scale, but was unhappy with other options on the market:<\/p>\n
\u201cTo solve this problem we developed a tool called Solidify (a play on Solidity) to increase the rate of new asset security reviews without lowering our high-security standard that Coinbase customers have come toexpect for protecting their tokens.\u201d<\/p><\/blockquote>\n
The Solidify tool has around 6,000 unique signatures which can be used to quickly match risks against Ethereum smart contracts. It looks at potentially dangerous functionality and insufficiently tested operations.<\/p>\n
Kacherginsky explained that: \u201cSolidify uses a large signature database and a pattern matching engine to reliably detect contract features and their risks, standardize and score smart contract risks, suggest mitigation strategies, and generate detailed reports.\u201d<\/p>\n
Solidify is not yet able to quickly analyze complex assets such as automated market makers (AMMs) and DeFi apps, because the large amount of complicated custom code involved requires additional manual analysis. <\/p>\n
\u201cHowever, Solidify is still beneficial for these applications when analyzing DeFi clones or for eliminating standard libraries from the manual review scope so analysts can focus on the custom logic,\u201d Kacherginsky notes. <\/p>\n