In this guide
What this covers
Most losses are not exotic exploits. They are approvals signed to contracts nobody read. This guide covers running an audit and, more importantly, reading it.
1. Audit before the approval, not after
Audit this contract before I approve it.Maren fetches the source, runs static analysis, checks known patterns, and reports findings by severity.
2. Read severity as consequence, not as a score
| Severity | Means | Action |
|---|---|---|
| Critical | Funds can be taken | Do not approve |
| High | Privileged action can harm you | Understand it explicitly, then decide |
| Medium | Behaviour differs from expectation | Note it |
| Low | Style and gas | Ignore for approval purposes |
"Unbounded owner mint" as a High is a good example of a finding that is not a bug — it is a design decision that transfers risk to you. Whether that is acceptable depends on who the owner is.
3. Check the approval scope separately
An audit is about the contract. Approval scope is about your exposure. Maren defaults to the exact amount:
Approve exactly 500 USDC for this contract, not unlimited.Unlimited approvals are the single most common vector for drained wallets, long after the original interaction is forgotten.
Verified source is table stakes. If a contract's source is not published, you are not evaluating code — you are trusting a stranger's bytecode.
4. Revoke when you are done
Standing approvals accumulate silently. Ask Maren to list active approvals periodically and revoke what you no longer use.
Tips
- Audit before every first interaction with a contract, not just large ones.
- Ask for the diff against a known-good implementation when a contract claims to be a standard fork.
- Wire the audit into CI over the API if you deploy your own contracts.
Troubleshooting
Unverified source. Treat it as a finding. Bytecode-only analysis is available but weaker; the right default is not to approve.
Clean audit, still lost funds. Audits cover code, not intent. A contract can be flawless and still be operated against you. Scope your approvals accordingly.
The controls behind this workflow
- Unverified source is treated as a finding in its own right.
- Approvals default to the exact amount, never unlimited.
- Critical findings block the approval flow rather than warning past it.
Guides describe how to operate Maren. They are not financial advice, and figures shown are illustrative. You approve every transaction before it is signed.