What is the audit process on substrate?

Question

What does it actually mean for a PR to be waiting for an audit on substrate, who is going to audit the code and how is it different from reviewing the code?

Answer 1

Technical perspective

Theoretically you are right; code reviews should already catch all errors in a piece of software.
This is a very far stretch as we know from experience.
The good part about code auditing is that it can be perfectly out-sourced and can thereby free resources that are needed to fix critical issues.
Auditors have the time to analyze complex software with different fuzzy tools and game theoretical analysis.
In that process they often find edge-cases and combinations of inputs that are difficult to imagine but can happen and would cause an error.

Imagine the developers had to do all the analysis that the auditing firm is doing; they would not have the time to do anything else.
For a project that multi-billions of USD dollars depend on, this additional level of security is needed.

Developer perspective

As a software developer its nice to have another company professionally invest their time to ensure the proper function of the written software.
This increases the experience of the developer and his self confidence.
It also calms the mind to know that there were no gross errors that slipped through.

Game-theoretic perspective

Code auditing is a tool to increase the level of reasonable trust that you can have in a piece of software.
This is done by having an external auditing firm analyse the software and stake their reputation by approving the piece of code.
If the software turns out to be grossly incorrect, the auditing firm loses its reputation.
A code audit is more valuable the more reputable the auditing firm is.

Auditing process

I can only give you a high-level overview as the exact details are security relevant.
After the code and (often also the reviews) are done; we ask the auditors to have a look at the code.
They come back after some time and tell us about the findings. We then fix these issues and proceed with the development process.
One auditor for example was Quarkslab, as stated publicly here.