Proof of Audit¶

Malicious project founders may falsely claim that their smart contracts were audited. The traditional way to check is OtterSec's website, which is the single source of truth and hosts the original audit PDF, but audit documents can still be forged and shared to spread misinformation.

OtterSec writes reports listing the vulnerabilities found in the smart contracts it audits. With Sign Protocol, OtterSec creates attestations stating that it has completed the audit of a given contract, the findings in the report, and which team member conducted the audit.

The schema¶

{
    "name": string,
    "domain": string,
    "repo": string,
    "findings": {
        "critical": uint8,
        "high": uint8,
        "medium": uint8,
        "low": uint8,
    },
    "auditor": string,
    "timestamp": uint64
}

The schema is also on SignScan.

When OtterSec completes an audit, the audit summary is recorded as an attestation on SignScan, and SignScan is then the single source of truth.