Methodology & Process

umibit AI full coverage + senior security experts' judgment

We lay out our audit process in full transparency. umibit AI runs a full-coverage review over all of your code so nothing is missed; senior security experts then validate each finding, eliminate false positives, confirm exploitability, and independently carry out the business-logic and economic-model analysis. The machine guarantees breadth; the experts guarantee judgment.

Two layers of scrutiny, each checking the other

Machine and expert each play their part — complementary, and cross-checking each other.

What umibit AI handles AI

Powered by umibit's in-house AI security engine, it makes a high-coverage first pass over all of your code — white-box, backdoors, CVE, off-chain, and black-box probing — to guarantee breadth, so nothing is missed.

White-box source scanning: semgrep rule sets + custom high-risk patterns
Backdoor / honeypot signatures and sensitive-function detection
Dependency CVE and SBOM version-range matching
Initial screening of off-chain infrastructure, keys, and configuration
Black-box probing: deterministic scanning + autonomous agent, on two tracks

What senior security experts handle 人工

Experts review the AI's output finding by finding, eliminate false positives, confirm genuine exploitability, write PoCs, and independently carry out the business-logic and economic-model analysis — bringing depth and judgment.

Manually validate each AI finding, eliminating false positives
Confirm genuine exploitability and write reproducible PoCs
Business-logic vulnerabilities and state-machine analysis
Economic-model / tokenomics and arbitrage-path review
Centralized privileges, deployment consistency, and final severity rating

Process

Audit Process

From scoping to a publicly verifiable final report — seven stages with clear accountability.

Initial Assessment

We define the audit scope, the list of contracts, the version / deployment addresses, and the documentation; both what's in scope and what's out is written down as the baseline for assigning responsibility.

Full-Coverage Review

umibit AI makes a high-coverage first pass over all of your code, identifying common vulnerability patterns (white-box / backdoor / CVE / off-chain).

Expert Validation & PoC

Senior security experts manually validate every AI finding: eliminating false positives, confirming genuine exploitability, and writing reproducible PoCs; they also independently carry out the business-logic and economic-model analysis.

Draft Report

We issue a Draft report: each vulnerability with its description, impact, PoC, and fix recommendation, along with severity and status.

Client Remediation

The client remediates per our recommendations and reports back; we answer questions and confirm the fixes as needed.

Re-Audit & Verification

We re-audit the specified remediated version, verifying each finding's status as "fixed / mitigated / acknowledged."

Final Report

We issue the Final report and publish it where it can be verified publicly, with version, contract address, and date.

Severity

Severity Level Definitions

Severity = Impact × Likelihood.

Impact ＼ Likelihood	High	Med.	Low
High	Critical	High	Medium
Med.	High	Medium	Low
Low	Medium	Low	Low

Level Definitions

CriticalDirectly leads to loss of funds or loss of control over the project; must be fixed before launch. A project with an unfixed Critical should not be used.

HighUnder certain conditions can lead to loss of funds or loss of control (including severe centralized privileges and logic errors).

MediumDoes not directly threaten user funds, but affects the protocol's normal function or causes harm under edge-case conditions.

LowMinor issues with limited impact, or non-standard implementations.

InformationalCode style, Gas optimization, and best-practice suggestions, with no direct security impact.

Status Definitions

OpenReported; the client has not yet acted on it.

AcknowledgedAcknowledged by the client but left unfixed, with their explanation and the residual risk.

ResolvedFixed by the client and verified by the auditor during the re-audit.

MitigatedNot eliminated, but the risk has been reduced by mitigating measures.

Checklist

Review Checklist

Transparent methodology: this is the checklist we work through item by item.

Centralized PrivilegesThe top priority in a token audit

mint authority: can the owner mint without limit / cap
owner privileges: pausing trading, blacklisting, freezing balances, changing tax rates at will
Trading switch: can the owner shut off trading for everyone in one move
Black / whitelists: whether they exist and whether they can be abused
Privilege governance: whether critical privileges are held by a multisig + timelock rather than a single EOA
renounce check: whether ownership is claimed to be relinquished while a backdoor is actually retained

Honeypot / Backdoor

Buy but can't sell: whether the sell-out path is blocked by special conditions
Only specific addresses can sell
Hidden skimming / logic: deductions or redirects concealed inside transfer
Fee manipulation: whether buy / sell tax can be changed to extreme values (e.g. 99%)

Economic Mechanisms

Reflection / fee-on-transfer: the math and rounding, and compatibility with external protocols
Liquidity: whether the LP is locked, and whether the owner can pull the pool and rug
Incentive / arbitrage paths: whether the design can be continuously arbitraged or manipulated
Oracle dependence / flash-loan / MEV risk

Classic Contract Vulnerabilities

Reentrancy: ERC-777 callbacks, fee-on-transfer + external-call scenarios
Integer overflow / underflow: safe by default in 0.8+, but older code / unchecked blocks need checking
approve race conditions / allowance management
Missing access control or incorrect modifiers
Upgradeable contracts / proxies: can the logic be silently swapped
Unchecked external call return values, low-level call risk

Deployment Consistency

Bytecode comparison: whether the on-chain bytecode matches the audited source (guarding against "audit A, deploy B")
Constructor parameters: whether the initialization parameters match the documentation

This methodology is a general framework; every project is tailored to its actual scope. Both what's in scope and what's out is stated explicitly in the report as the baseline for assigning responsibility.