Comparing HYDN Seal and ERC-7512: on-chain audit representations
Blockchain users need a transparent, verifiable way to check that a smart contract has been audited. Two initiatives try to provide one: the HYDN Seal, introduced in 2022, and the recently proposed ERC-7512.
HYDN Seal
HYDN is a blockchain security company specializing in Smart Contract Audits, Web3 Penetration Testing, and Proactive Fraud Prevention. It introduced the HYDN Seal in 2022 in response to growing distrust and security concerns in the Smart Contract Audit space.
A HYDN Seal shows that an audit is genuine. It works like this:
- Provable security. Each HYDN Seal is an ERC-1155 token stored on-chain, which shows that all contracts have been audited. Because the record is on-chain, fake audit badges are not possible, and users can easily verify that an audit is authentic and when it took place.
- Transparency. The token contains essential metadata about the audit, such as the hash of the contract bytecode, the audit date, and a link to the report. Anyone can query the smart contract to check validity.
- Code validity. HYDN also takes the time to check that the deployed code matches the code that was audited, and does not issue a Seal without verifying this. It stops projects deploying un-audited code while claiming to have been audited.
- User-centric. HYDN Seal shows the audit date on the NFT, so users know when the contracts were last audited and whether anything has been modified since.
ERC-7512: onchain audit representations
ERC-7512 was proposed by a group of security researchers, including representatives from Safe, OtterSec, ChainSecurity, OpenZeppelin, and more. It aims to standardize on-chain audit report representations. The proposal emphasizes:
- Standardization. ERC-7512 introduces a uniform method for representing audit reports on the blockchain, which removes the need for manual verification.
- Trust establishment. By allowing users and dApps to verify audits conducted by reputable auditors, ERC-7512 aims to create an on-chain reputation system for auditors.
- Future-proofing. The proposal leaves room for future extensions, such as support for additional standards and networks, better handling of polymorphic contracts, and mechanisms for managing signing keys for auditors.
Problems with trust for ERC-7512
It suggests a project is secure
Users may trust a project more if ERC-7512 confirms it has been audited, but that doesn’t necessarily mean it can be trusted. Currently the proposal places an emphasis on “positive audits”. If four audit companies carried out audits and one found no issues, but three found a Critical Issue, it would still say the project has been successfully audited, because it makes no mention of the findings.
A user could end up trusting and using a protocol with a critical vulnerability without knowing it.
No easy solution
Both HYDN Seal and ERC-7512 aim to improve transparency and trust in the blockchain ecosystem, and both have limitations. As covered above, ERC-7512 can lead to trust in a project that actually has vulnerabilities.
HYDN Seal mitigates this by verifying that the deployed code matches the audited code. Once a project makes changes to its contracts, the audit is invalidated. But the extra time this verification adds to the audit lifecycle is a problem of its own. In our experience, some projects don’t deploy for months after an audit, meaning that our auditors have to go back in after a long wait to verify the code is the same.
Conclusion
ERC-7512 is a commendable community effort to standardize on-chain audit representations, but it still comes with a number of problems including trust, implementation, over-complexity and more.
To learn more about HYDN Seal or book a Smart Contract Audit with our team fill in our Contact Form.
