# OP Labs Audit Framework: When to get external security review and how to prepare for it

**URL:** <https://gov.optimism.io/t/op-labs-audit-framework-when-to-get-external-security-review-and-how-to-prepare-for-it/6864>\
**Category:** ✨ General\
**Created:** [September 26, 2023, 1:13am UTC](https://gov.optimism.io/t/op-labs-audit-framework-when-to-get-external-security-review-and-how-to-prepare-for-it/6864 "2023-09-26T01:13:21Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![maurelian](https://dub1.discourse-cdn.com/bc41dd/user_avatar/gov.optimism.io/maurelian/32/9353_2.png) [@maurelian](https://gov.optimism.io/u/maurelian)\
**Post date:** [September 26, 2023, 1:13am UTC](https://gov.optimism.io/t/op-labs-audit-framework-when-to-get-external-security-review-and-how-to-prepare-for-it/6864/1 "2023-09-26T01:13:21Z")

</div>

Hi all, maurelian from OP Labs here. In this post, we are sharing an internally developed framework for identifying code which we believe should be audited prior to production deployment.

Our purposes for publishing this framework are twofold:

1. Providing an example which other contributors to the OP Stack may take into account when deciding how to get audits.
2. Seeking feedback from the community. Since Optimism Governance is the ultimate decider of what gets shipped to production, it’s important to ensure that the efforts made by core contributors like ourselves align with community expectations.

## The Framework

This framework provides guidance to teams at OP Labs who are writing security critical code for the OP Stack and are interested in obtaining external review, including:

- A security review or audit from a security firm.
- A community audit competition from a platform such as Sherlock.
- A bug bounty

It will describe what code should, from our perspective, be audited, and how to prepare for an audit.

### Philosophy Behind External Security Audits

It is important to underscore that security starts with the developers. An audit should not be seen as a means of “purchasing a security guarantee” from an external vendor.

What a security vendor provides is:

1. Feedback and insight into your ability to write secure code.
2. A final assurance about the specific code you have developed.
3. A public artifact attesting to the security of the system.

### What code should be audited?

Audits are expensive and time consuming, so we recommend using them in a targeted manner.

Generally, audits are better suited for some kinds of codebases, specifically those where **_Safety_ is of _Existential_ importance**.

The following rubric divides projects along Liveness vs. Safety and Reputational vs. Existential axes.

 ![audit-rubric](https://europe1.discourse-cdn.com/bc41dd/original/2X/8/8d9928784ad86c4080e3d97a8d0c80f1b55970fb.png)

The rubric above is not exhaustive, but should give a sense of the framework OP Labs uses to determine what requires an audit.

Most OP Stack code fits into one of the following buckets:

1. **Secure via testing and real world usage:**
  - This applies largely to infrastructural code, referring to components such as op-node, op-geth, op-batcher as well as alternative implementations of such components.
  - In general, audits are less valuable or necessary for infrastructural code because:
    - Experience has shown us that auditors provide less value with infrastructural code, especially relative to what is learned by getting code running on a testnet or putting code in users’ hands.
    - When issues do occur in infrastructural code, they can be addressed through ‘social consensus’, ie. quickly disseminating new software with a bug fix.

2. **Secure with extreme caution (including auditing):**
  - This applies largely to smart contract code, in particular in cases where assets are being secured.
  - Examples include modifications to bridge code, changes to deposit derivation code, multi-sig wallet modifications, etc.
  - In general, audits are necessary for smart contract code because damage resulting for vulnerabilities is more likely to be irrecoverable.

There are likely to be situations where smart contract code does not require an audit, and where infrastructure code should receive an audit. _Every_ case requires a fact-specific analysis about whether an audit should be required.

And while there is no “magic formula” that works in all cases, analysis according to the Existential vs. Reputational x Liveness vs. Safety framework is more important than simply differentiating between infrastructure and smart contract code.

## Preparation for external security review

Once again, secure code starts with the development teams that write it. We recommend completing the following steps for a given codebase prior to seeking external review.

1. **Enumerate the invariants and security properties of the system**

2. **Documentation for security researchers**

3. **Test coverage assessment**

## Conclusion

We believe that this framework provides a strong foundation for both development teams and governance in evaluating the necessity of an external review OP Stack code.

---

_[View the full topic](https://gov.optimism.io/t/op-labs-audit-framework-when-to-get-external-security-review-and-how-to-prepare-for-it/6864)._