Guide from Hacken: How to choose a secure yield farming platform?
Home | News & Insights Guide from Hacken: How to choose a secure yield farming platform? The quest for the best yield farming platform is underway. You have already studied the light papers and know the average APYs across the market. The next big step is to look into security. So many questions. Where to start, and what’s essential? How to calculate the risks? Where to get objective data? How long would it take? With a little bit of expert help, you can easily perform your own accurate and time-efficient Due Diligence to get ahead of the curve. We teamed up with a leading blockchain cybersecurity company Hacken to get the answers. We chose Hacken because they are industry experts in smart contract audits and know everything about blockchain security. CoinMarketCap and CoinGecko recognize Hacken’s audit reports, which speaks volumes about their industry recognition. Hacken is at the forefront of industry-wide smart contract audit standards as they are one of the contributors to EthTrust Specification. With five years of experience, 180 partners, and more than 1,000 protected clients, Hacken is among the top blockchain security auditors. Here’s a step-by-step guide from Hacken’s cybersecurity experts on how to choose the most secure platform for yield farming. Step 1. Check Scope and Relevance of Smart Contract Audit It’s impossible to overestimate the importance of smart contracts for yield farming platforms. A Smart contract is a code that governs and automates transactions. It typically consists of multiple functions, such as staking, withdrawing, lending, etc., that power up a DeFi platform’s operations. Secure smart contracts work as intended every time without any loophole for manipulation. Unfortunately, smart contracts are rarely without vulnerabilities. The most common are: All these vulnerabilities enable data breaches or private key leaks. The good news is that yield farming platforms can address these vulnerabilities with an external audit. An external audit is basically a thorough code review to ensure that all functions of the smart contract code work as intended without any hidden loopholes. Writing perfect code is almost impossible because developers are only humans who occasionally make errors. This is especially true when devs are constrained by time and resources. Smart contracts are vital for secure yielding platforms, but not all audits are created equal. Relevance and coverage are two main questions you must consider. The audit must be relevant and cover the entire project. Web3 projects typically have multiple smart contracts to ensure all of their features work as intended. All contracts (not just one) must be audited. Checking audit relevancy and scope with an example Step 1. Locate Public Audit Let’s take a look at one of Hacken’s clients, Zharta — a lending platform. Notice “Auidited by Hacken” badge on their website. Conveniently, Hacken website provides a list of all the public audits it has completed. We can easily locate Zharta’s audit here. Step 2. Locate a codebase repository First, let’s head to the “Scope” section on Page 4. We have a link to the repository and commit. The repository here matches the codebase that Hacken audited. Step 3. Check audit relevancy Once in their GitHub repository, notice the date of the last commit for ./protocol-v1/contracts/ (highlighted in red). The date of the last commit matches the date of Hacken’s audit. As a result, the audit is 100% relevant (as of the day of writing). Step 4. Check audit scope Inside the same folder (protocol-v1/contracts/), we have counted the number of key files — 12 smart contracts in the Vyper programming language. Inside the protocol-v1/interfaces folder, we count 11 contracts. Noooow, let’s compare this number with what’s inside the audit report. Go to Hacken’s audit report once again, and locate the Audit Scope section for the Fourth review scope. The audit by Hacken reviewed 12 contracts in the ./contracts folder and 11 contracts in the ./interfaces folder. Zharta’s codebase is powered by the same number of contracts. Therefore, the audit covers close to 100% of the key on-chain functionality. Step 5. What about vulnerabilities? It’s finally time to look at found issues inside the report. Hacken found 2 critical issues, 16 high, 5 medium, and 4 low. Three iterations later, Zharta developers resolved almost everything. You can read more about each found issue and how it was fixed in the report. Also, the final audit score is 8.4 It’s time for conclusions The Zharta landing platform has almost perfect audit coverage and relevancy with a very high score of 8.4. However, not all audits are this diligent. Unfortunately, we have hundreds of crypto projects with low coverage and a codebase that is no longer relevant. Again you can check Audit Relevancy and Audit Scope metrics at CER.live, but not all projects are listed there yet. Step 2. Is the Blockchain Protocol Safe? A protocol audit is different from a smart contract audit. Yield aggregators can interact with one or more blockchains. Leech, for example, works across 12+ blockchains. Some chains, such as Ethereum or Avalanche, are well-established with minimal security concerns. New chains are less recognized and don’t enjoy the same level of trust. DefiLlama lists 290 yield farming protocols working across more than 50 chains in total. You cannot assume that each one is safe. A new chain can earn trust by having an external blockchain audit. To verify whether a blockchain is audited, go to its website and check for the security page. Alternatively, information about the audit can be retrieved from the project’s repository on CoinGecko’s Security tab. Step 3. Background Check The significant purpose of a background check is to minimize the risk of a rug pull. Not all founders have the best intentions in mind. Some are growing their yield farming business with the sole goal of running off with users’ and investors’ assets. You’ll never see them again, and no one will return your money. Rug pulls happen almost monthly, so stay clear of fraudulent projects. Reputation is everything in a trustless environment. Look for LinkedIn pages, video interviews, and other valuable information about the platform’s founders. Who are they? Are they DeFi experts with a proven track record or amateurs with risky ideas and no