I began the Wildcat audit contest on September 5th, 2024 though the Wildcat audit officially began in August 31, 2024. From the outset, I knew a well-structured plan was important for success, “He who fails to plan, plans to fail 😂“. Having recently completed an internship with Guild Audit where we were taught various approaches and methodology, I developed my auditing methodology and applied it here. My plan was straightforward:

• Day 1: Study the docs

• Days 2-5: Read the codebase

• Day 6: Draw a diagram explaining the flow of the project

• Days 7-8: Test key features of the code

• Day 9: Test all assumptions

• Days 10-14: Thoroughly audit and test every function in the codebase

I began by diving into the documentation, which gave me a solid foundation of what Wildcat Protocol aims to achieve. Briefly, Wildcat provides an opportunity for borrowers to access undercollateralized loans. The protocol allows on-chain credit where borrowers set the terms for the market. Lenders decide whether to accept those terms, forming the market when both parties agree.

Once I understood the docs well, I moved on to understanding the codebase. A strategy I learned from one of my mentors involved writing down what each function does. This hands-on approach helped solidify my understanding of the contracts. To keep track of my notes, I created a dedicated Discord channel where I documented every contract and its functions. Although this process was tiring, it was effective—I managed to cover about 80% of the functions, which helped me focus on the key parts of the code.

During this phase, I also identified potential attack paths and noted questions that I wanted to answer as I progressed. Unfortunately, I fell ill for a few days and had to take a break. When I returned, I skipped the diagramming step and focused on testing the attack paths that I jotted down.

Despite the setback, I discovered four issues that I believe are significant. I wrote test cases for each, and all of them passed. However, I’ll only know if they’re validated after the judging process, I pray they are all validated😎. I also went back to the codebase, asking several questions to the developers, who were very responsive and provided valuable insights.

During the audit, I collaborated closely with my friend Fatima. We both studied the codebase together, exchanging ideas and insights along the way. Once we completed our analysis, we worked together to draft the final report and submitted it.

I was genuinely happy with the outcome of this contest. Not only did I manage to submit issues, but I also gained a deep understanding of the codebase.

Lessons Learned:

1. Stick to your timeline, time management is key.

2. Never fully trust what the developers say or the existing tests.

3. Thoroughly understand the codebase; it’s the foundation of any good audit.