How to get your Project Audited?

Hey everybody, this is James Pelton. I hope you're having a good Tuesday. This is really fun for me. I'm having on today, Joe, who's a member of my audience. He's been a subscriber for a long time. He took advantage of, you know, I opened up my scheduling link to just spend 10 minutes praying with, you know, people in my community, people, subscribers, people in my audience. And so I've got to know Joe pretty well through that. And so I just wanted to bring him on to kind of talk about his auditing services that he offers. So before we introduce Joe and just kind of talk through what it is that he does, the reason that I think that there, this is potentially a good idea for people is because a lot of projects when they're starting out, one of the most common things I always ask, hey, do you have an audit? Do you have some kind of an audit or something like that? And usually people say, no, they're too expensive. I can't do that. I can't get an audit, anything like that. So that's where people like Joe can come in and really help you out when you're first getting started. Because obviously, you know, Certik is going to charge quite a bit. I think it's 6K, a smart contract. So if you have three smart contracts, it's going to cost you 18K to use Certik. And again, that's just cost prohibitive for a lot of people when they're starting out. Joe, you know, he's not going to have quite the badge that Certik does. You know, people might not have heard of him as much, but it's going to be a lot cheaper and it's still a good way for him to just look through your smart contracts and just for you to be able to tell someone, hey, we've had someone look through our contracts that we're not a honeypot. We don't have a backdoor where somebody can empty the whole contract, things like that. And you don't have to look through the code yourself. So that's amazing as well. So as we're getting going, please hit the like button. Appreciate that. Let's turn it over to Joe. Joe, can you start us off? Just a little quick introduction of yourself, little bit of your background. Yeah, sure. Hi everybody. My name is Joe Dacqua. I basically entered the blockchain space back in 2013. I was introduced by a close friend of mine and I started out just by mining basically, mining Bitcoin. And we got in touch with a cloud service provider and just started doing basic mining that way. And then as I started to get to grips with Bitcoin and how it programmatically worked, I started to dive a little bit deeper into it. Eventually, consulting across a number of sectors, including like law and property because what a lot of companies started to do was take advantage of Ethereum and tokenizing assets and things like that. So I started to speak to a lot of like lawyers, solicitors, business owners that wanted to like really branch out into this space. And that was off of the back of mainly reading the Ethereum yellow paper for me, is really understanding that. And I kind of saw a lot happen in between 2013 up until 2017 when we saw the ICO crisis and shall I call it that? But yeah, there was like a big frenzy towards ICOs. And then we saw like certain legislation come out and there wasn't that much clarity on what the difference was between security tokens and utility tokens. And I was helping people sort of clarify what that looks like perhaps. And then I started to advise on a number of investment funds, one being based out of Australia that was a crypto fund, did another advisory position at a company in London that were sort of tokenizing cars and things like that. So quite unique stuff. And then yeah, basically start to branch out into developing, mainly software developing, but started to get into blockchain development, learning solidity, naturally pick up a lot of security tips doing that. And yeah, basically that's where I am now, sort of really branched out into a deeper understanding of the EVM and how smart contracts work programmatically. So yeah, quite exciting times. Okay, very cool. Yeah, no, I just love your hustle. I do want to talk a little bit about that here in a little bit as well, about maybe there's people watching who want to become a blockchain developer. There is high demand. I get asked probably five times a day, hey, do you know any blockchain developers? And then I'm always scrambling around. Oh yeah, I know this, this and this, but there's a huge need. There's way more projects that need developers than there are developers available. And that's a good market to be in. But before we get to that, I want to talk just about your project auditing. So can you kind of walk us through just a little bit, what is your process in getting a project audited? What are the main things you look for? Things like that. And before that, I do want to just mention too, we know that there is a video delay. It's the beauties of doing live things. So the audio is fine. Video's delayed like two or three seconds. So just ignore it, okay? Pretend that he's speaking another language and it's just dubbed or something like that, okay? Pretend that's what you're watching. But Joe, can you walk us through what you look for in a smart contract audit? Yeah, and I do apologize about the delay. Yeah, sure. So ideally, I'd like to see some documentation. That's the most important part for me is to really understand what the protocol is doing. If it's a basic NFT smart contract or an ERC-20 token, it's kind of self-explanatory. But the majority of protocols that I look at are a little bit more complex and multiplicit. So ideally, some documentation detailing what the protocol does, and that might be titled in each section or it might be an organogram of what everything is doing, which smart contracts are talking to which smart contracts. That's always very useful and it helps me get a mental understanding of what is actually happening. And it gives me insight into how the developers have thought about comprising the contracts, basically. So that's the first thing I often look for. And then I'll always ask questions and talk to the developers and understand them as people and what drives them and what's really motivated them to create the protocols. Because that, again, gives me another insight, a slightly different insight into the creativity behind the project. And then, of course, I like to get into the code itself. And that's basically just a manual review where I'll scan the contract line by line, looking for things that I think might stand out for me as an auditor. And then I'll dive back into the docs. So I'll go back into the documentation because more often than not, the documentation needs auditing. And then it sort of gives you a different approach when you go back into the code and you see it slightly differently. And then from time to time, I do run some automated and semi-automated analysis. It's not something I tend to rely on because 80% of vulnerabilities and bugs that I found in smart contracts were found manually. So I tend to steer away from that as much as possible and mainly just look out for some of the more common bugs. But most of the bugs are business logic related. So that's something that I'm particularly keen on looking out for. But all in all, that's my process, really. It's not too complex. So I like to stay in constant communication with the developers and ask a lot of questions. I think that's really important. But apart from that, that's as simple as it gets, really. Okay, very cool. And can you kind of talk about the difference in pricing between, like I mentioned, Certik charges, I think it was 6K, maybe it was 5K if you do three or more. What would the price comparison be between using like Certik or using just you having? Yeah, sure. I mean, yeah, they've got a badge, haven't they, right? It's a brand and that's how they work, effectively. And you can't fault them for it, really. You've built a brand in the space and it gives confidence to investors, then protocols are gonna use them. But I think the advantage of using solo auditors is that, yeah, the price is a lot lower. They also tend to put a little bit more personal effort into it because more often than not, big audit firms have one or two, maybe three auditors look at the same smart contract. And so it's like, you don't get that personal one-to-one relationship and it's a slightly different level of understanding because you've got three brains constantly going back and forth in the code and there's might not necessarily be any cohesion there. So some things can get lost in translation. But as far as costs are concerned, yeah. I mean, I tend to look at the protocols based on the source lines of code. But again, it's gonna be nothing in comparison to that. And I would say normally, if it's a basic NFT smart contract, you're looking at anything between 500 and $1,000. If it's a little bit more complex with a dozen or more smart contracts to audit, then you're looking between 3,000. If it's even more complex and you've got 20 plus, which I've come across before, then I think the max I'd be looking at is 5,000. And I normally do that on a weekly basis, but it would really depend on, again, on the source lines of code and the complexity of the code base, basically. But there's definitely flexibility there and certainly not expensive in comparison to some of the big audit firms, for sure. Yep, absolutely. And also another thing I found, one complaint I get from people who use Certik is they say, oh, they weren't very responsive. They weren't very quick about working through issues. And if you're looking to launch soon, you kind of need that. You need like, hey, what do we need to fix? And we need this quickly. So again, one of the benefits of working with somebody kind of more on a one-on-one basis rather than a big company like Certik. So really like that. Definitely, yeah. So last question. Oh, we got some questions from the audience. Thank you, guys. You guys are awesome. What are some red flags investors can look out for in smart contracts, such as non-revoked contracts? Good question. Yeah, because I'll tell you what, it's quite interesting, because I'm in a number of communities in Telegram and Discord, and I'm an investor myself. So I used to, before I even started developing and auditing, I used to ask very similar questions. And it's interesting, on being on the other side of the fence now, I can sort of see the red flags to look out for that you weren't really aware of before. And I'd certainly say it's quite difficult unless you know how to read smart contracts. So I would advise people to learn how to do that. But typically, you've got to look at access control. So what I mean by that is, are there bad actors within the protocol themselves that are able to do certain things that would be at the detriment of the investors and users? I think you should definitely actively ask questions to the lead developers if you are involved in a project. And you tend to see from their reaction how legitimate it is. There's nothing wrong with probing people. I think you need to, it's encouraged. So that's one of them. Apart from that, a lot of the other red flags are, unfortunately, they are going to be code orientated. So you really do need to get a basic understanding of what the code is doing. And then you'll sort of notice, oh, okay, right, there's a few other red flags here. I would say that would be my best advice in terms of what to look out for. I mean, only just because I've been an investor myself. So, yeah. Yeah, and it's very advantageous to have a auditor who is an investor also. Because, yeah, again, they know what's going to be important to people, what people are looking for. They know what has burned us in the past. These audits have kind of grown over time where you kind of learn more and more things that you need to look out for as time goes on. So really appreciate that. Oh, definitely, yeah. There's lots of things you get to grips with in terms of noticing what the red flags are, for sure. And it just comes with a little bit of experience. Unfortunately, sometimes you kind of have to get a little bit burned. We've all been there, rug pulls and all the other excuses that come under the sun. But yeah, I think certain people go through that to make the decision-making and the process a lot easier for newer investors, basically. Okay, very good. So last question before, we got more questions coming in. How long have you been involved in the DeFi space? What was your first investment in this space? I've been involved in DeFi right from the beginning. So when we saw the DeFi summer take off, I was investing in protocols like Beefy Finance and there was a bunch of others as well that, for example, Andre from Phantom Launch that I was involved in. And I think James and I will probably be familiar with the likes of Drip. That was one of my first investments. What else was there? There's Strong. I was involved in Strong. All the good ones. All the good ones, yeah, definitely. But yeah, I've been involved in DeFi since its inception, really. Okay, very good. Yeah, it's got a lot of experience. And we've had some good talks just talking through different projects and things like that. So maybe last question on the auditing side, then I do want to talk a little bit about programming. But if there's people watching, project founders watching, potential project founders watching, what's the best way for them to get in touch with you if they would like to do an audit for themselves? Yeah, sure. I think the best way is just to DM me on Twitter. I often have lots of conversations with founders and protocols that way. So it's probably the easiest way to get ahold of me. I'll kindly ask James to share my handle with everybody that is interested. So that would be the best way to get ahold of me. Yep, so I just put that in the chat so you can shoot him a DM. And also, if you're not, go ahead and hop on his Twitter and follow him. Again, getting that follower count up and stuff like this. Again, my goal is just to help people in my community. So I really appreciate Joe and his hustle, getting into blockchain programming, starting his auditing, things like that. So I just want to help get exposure to that. So that's why we're doing this video. But yeah, even if you're not a project founder or anything like that, just hop on his Twitter and give him a follow. When you see him post out stuff, retweet it, things like that, that will all help. Before we wrap up, I would like to talk a little bit about your programming journey. How difficult, so you were a traditional programmer before, correct? Yeah, so I mean, my background is very varied, actually. I've got a background in recruitment. I did for many years. But what I did on the side was ultimately relating to all the knowledge that I'd gained from the blockchain space. So the first language that I started to use and learn was Golang, Google language, which was not like, probably not the best choice in terms of learning blockchain development. But it sort of gave me a good solid grounding into how to approach programming in general. So that's how I got into it really. And yeah, started to build projects. Mainly, I'll be honest with you, I started to look at tutorials. Because a lot of people, when they enter, they're sort of like, well, what do I build? I don't know what to build. And it's like, well, there's nothing wrong with following tutorials initially. I'll say that hand on my heart is the best way to approach it, in my opinion. And then when you're comfortable with the basic fundamentals, then you can start thinking creatively about what you'd like to build. And by all means, there's developers in the space that are very helpful. And I would encourage you to reach out to developers, join discord groups where developers are congregating and message them, they're very helpful. And you can get some great ideas from that way. And you can then build a portfolio, put it on your GitHub, on your CV, start making some inquiries, just knocking on doors and being consistent. And that's basically what I did before I was given my opportunities. So that would be my advice. Okay, very cool. Yeah, no, and that's basically the same thing that I did. I use chat GPT a lot. So if you have a traditional programming knowledge, then it's not too hard when you go to chat GPT and it gives you some code. It's not too hard to kind of read through it and say, oh, okay, it's doing this, this, this, and this. Chat GPT can help with some of the bugs too. It's not perfect. You still have to know how to program a bit. You can't rely on it 100%, but it's good. And then yet there's a lot of good tutorials out there. I've thought about doing like a training course, teaching traditional devs how to get into web three. But then I have too many things I'm doing. So I decided against that. But if somebody else, somebody watching, maybe Joe, if somebody wants to do that, I think that would be super beneficial. I would definitely say the other, there's a couple of other routes you could take. I mean, I learned also Crypto Zombies. That's a really good platform. And learned web three DAO. That's headed up by Casey Ahmed. Those guys have got some really cool material together for, even if you've got no experience as a developer, you can learn the basics that way. So I would strongly suggest you head over to there. I can repost their Twitter details for you. It's not a problem. But yeah, that's a good shout to start, to be honest. Yep, yep, totally agree. I was on Crypto Zombies quite a bit. Their community too, not just the course, but they have a pretty big community that's able to answer. You know, you'll find in programming, usually you run into things that the tutorials don't cover. And so then that's when you need a big community to kind of help you work through those things. So, awesome. Well, hey, I want to encourage anyone watching. If you want to improve your financial situation, you know, one way to do it is investments, obviously. That's what my channel is mainly focused on is, you know, we take some money, we put it into this, we put it into this, we put it into this. And hopefully the goal is your financial journey goes forward. But another way is doing what Joe's doing, where he's creating businesses. Again, I want to emphasize to people, I didn't make most of my money from crypto investments, right? I came with a bunch of funds that I made through a business I started. So I want to just encourage and support and do whatever I can to help anyone in my audience who is trying to start a business or just trying to provide value to other people, reach out and I'd love to just bring you on. You know, even if it's just like here, we're just going to do this 20 minute thing, just showing here, here's Joe and here's what he's been doing. I'm happy to do this and just get, you know, what exposure we can on things. So I want to thank the audience. You guys are amazing. Love my community. Appreciate you guys so much. And Joe, thank you so much for just hustling and putting effort in, providing value for people. And I look forward to kind of seeing how this grows over time. Yeah, awesome. Yeah, no, appreciate that, James. Yeah, thank you. Yep, and if anybody, project founders, you're watching, you need an audit, you don't have $20,000 to spend, hit Joe up. Again, Joe, go Lang, is it Langer? Is that? Langer, yeah, yeah. Langer, okay, go Langer85 on Twitter. Just go, give him a follow and shoot him a DM if you're interested. Maybe you just too want some guidance in your programming and you say, hey, I want to pick up programming. I want to be a blockchain developer. Reach out to Joe. He's kind of going ahead of you in this space. So Fonituro, thank you for the great questions. Thank you everyone who watched and I hope you all have a great rest of your day. I'll be back tomorrow. Thanks, everybody. Cheers, James. Cheers, guys. Thanks, Joe.