Why Your Audit Report Is Useless Without a Threat Model

Audits check if a paymaster works, not if it can be economically drained. A malicious user can craft a transaction where the paymaster's gas refund logic is exploited, forcing it to pay for infinite computational loops or bloated calldata.

• Attack Vector: Malicious validation logic in a validatePaymasterUserOp that passes checks but triggers expensive downstream execution.
• Real-World Precedent: Similar to early Ethereum gas token refund exploits, but now the victim is the protocol's gas treasury.

Smart accounts using solvers (e.g., via UniswapX, CowSwap) for intents create a new trust surface. A solver can propose a valid but maliciously routed cross-chain transaction via a bridge like LayerZero or Across, sandwiching the user or draining MEV.

• Systemic Blind Spot: The account's signature validates the intent, not the solver's execution path.
• Consequence: Loss of funds or value extraction even with a 'verified' signature, breaking the user's mental model of security.

Audits treat session keys as simple EOA signatures, ignoring their temporal and contextual permissions. A key with a broad update permission can be used to escalate privileges after the audit period, or a revoked key may still be valid for pending bundled transactions.

• Core Issue: Dynamic state (validity, permissions) exists off-chain or in mutable storage, creating race conditions.
• Unmodeled Failure: A governance attack or admin key compromise can retroactively invalidate all security assumptions of a previously audited session key system.

The 2021 hack wasn't a cryptographic failure but a systemic logic flaw in cross-chain message verification. A threat model would have forced the team to define and validate the trust boundaries between the Poly Network's core contracts and the external relayers.\n- Failure: No formal mapping of privileged roles and cross-chain message flows.\n- Lesson: Threat modeling forces you to codify assumptions about external actors like LayerZero or Wormhole relayers.

A single initialization error led to a $190M free-for-all because the system lacked a threat model for state consistency. The flaw allowed any message to be replayed, treating the bridge like an unchecked mempool.\n- Failure: No analysis of "what if a trusted actor's input is maliciously crafted?"\n- Lesson: Threat modeling surfaces data integrity risks that generic audits miss, similar to risks in Across or Synapse.

A price manipulation attack succeeded because the protocol's threat surface was narrowly defined. The team secured the smart contracts but didn't model the oracle's dependency on a single, low-liquidity DEX pool.\n- Failure: Threat model omitted the off-chain data sourcing and latency as a critical attack vector.\n- Lesson: A complete threat model extends beyond contract code to oracle providers (Chainlink, Pyth) and their failure modes.

Firms like Trail of Bits and OpenZeppelin now mandate threat models before the audit. Without it, auditors test against a generic list, missing protocol-specific logic risks. The Ronin Bridge exploit ($625M) bypassed a 5/9 multisig—a failure of trust assumption analysis.\n- Failure: Audits verified the multisig code worked, not if the signer set was over-privileged.\n- Lesson: A threat model transforms an audit from a code review into a security investigation.

Audits verify the code matches the spec. They are blind to flaws in the spec itself, like economic logic errors or protocol-layer attacks. A threat model maps the entire attack surface—frontends, oracles, governance, and cross-chain dependencies—that code reviews ignore.

• Identifies Systemic Risk: Exposes cascading failures between components like price feeds and liquidation engines.
• Prioritizes by Impact: Focuses resources on protecting $100M+ TVL vaults, not low-risk view functions.

Without a defined adversary, you test for bugs, not breaches. A proper threat model defines attacker personas (e.g., a whale with $50M capital, a malicious validator) and their capabilities, forcing you to simulate realistic exploits like MEV extraction, governance attacks, or oracle manipulation seen in protocols like Compound or MakerDAO.

• Proactive Defense: Models attack vectors before they are exploited on-chain.
• Quantifies Cost-of-Attack: Estimates the capital required to break your system's economic security.

Smart contracts are immutable, but their environment is not. An audit is a point-in-time review. A threat model is a living document that evolves with new integrations, layer 2 upgrades, and changes in the DeFi ecosystem (e.g., new Curve pools, EigenLayer restaking). It mandates continuous monitoring of dependencies.

• Future-Proofs Architecture: Plans for upgrades and third-party risk from bridges like LayerZero or Wormhole.
• Enables Incident Response: Pre-defines escalation paths and mitigation steps for identified threat scenarios.