you MUST do this in the next audit

You spot something weird on day 3, promise to come back to it, and never do. Here's the 3-part row I write so every lead is still there when I need it.

Someone asked me this live, during a workshop:

“During an audit, I forget everything quickly. I get confused when I take notes.”

I know this feeling.

Day 3 of an audit.

You see something weird in a function.

“I’ll come back to it.”

You never do.

Today I’m sharing the 3 rules I use so a lead survives until the last day of the audit.

Stop reasoning in your head

After a week of line-by-line review, you forget things.

That’s normal. It’s how the brain works.

The problem is where you do the thinking.

Reason in your head, and leads fall out.

Keeping the whole codebase in your head is a disaster.

Your notes have one job: hold everything your head drops.

• Every thought, cut to one line

• Every open question, parked

• Every lead, kept until it’s closed

I tried a lot of setups before I got there:

• Diagrams

• Code pasted into Miro

• Raw notes in VSCode

Miro got the closest.

The whole codebase fit on one screen.

It showed me the code.

My questions about the code had nowhere to go.

Now I use Notion, in 4 layers:

1. The system

2. Each flow

3. Each function

4. The line

A question goes into the layer it belongs to.

Do this now:

1. Open your current audit

2. Write down every “I’ll come back to it” from this week, one line each

3. Put each line under the flow it belongs to

Give every lead one row

A lead in your head is gone by Friday.

Write it down the moment you see it.

Every lead gets one row, with 3 parts:

• Where: the function and the line

• Why: what looks wrong

• What breaks: who loses money if it’s real

Here’s the difference.

In your head: “something off with the fees”

As a row:

• Where: withdraw, the fee line

• Why: the fee rounds down to zero on small amounts

• What breaks: the protocol, if a user splits one withdraw into many small ones

The first one is gone tomorrow.

The second one you can test.

Then I mark the line in the code itself with //@audit.

So I land on it again in one second.

The row tells you what to check. The marker tells you where.

Before you close this tab:

1. Pick the last 3 leads you parked

2. Give each one a row: Where, Why, What breaks

3. Put //@audit on each of those lines in the code

Let one row grow into a chapter

Sometimes one row keeps pulling you back.

Don’t close it. Grow it.

In one audit, I had a row that said “leverage update and its behavior”.

For me it wasn’t one lead.

It was a whole chapter.

I covered it in every flow:

• Open

• Withdraw

• Liquidate

Backwards, actor by actor.

It ended in a critical bug, and $11K.

You only see that when the row is written down.

Tonight:

1. Open your notes

2. Find the row you keep coming back to

3. Walk it through every flow that touches it

4. Write one line on what it does in each

Write the lead down on day 3.

You won’t remember it on day 10.

In my private Audit Program, your notes and your leads are what you submit for review, every phase, by the deadline.

Then a live call at the end. We go through every bug you missed, and the step that would have caught it.

https://www.arsen.ac/web3-guided-audit

— Arsen