Smart contract audits: a founder's pre-launch checklist
Most exploited contracts weren't hacked by genius adversaries — they shipped with a known, avoidable mistake. Here's what to lock down before mainnet.
An audit is not a rubber stamp you buy at the end. It's the last check on a process that should have been security-minded from the first line. Use this checklist to get there — then bring in independent eyes.
1. Access control
Who can do what? Every privileged function (mint, pause, upgrade, withdraw) needs explicit, intentional permissions. Prefer roles over a single owner, use a multisig for admin keys, and write tests that prove an unauthorized caller is rejected. Mis-scoped permissions are the most common high-severity finding.
2. Reentrancy & external calls
Follow checks-effects-interactions: update your state before you call out to another contract. Guard value-moving functions, and treat every external call as potentially hostile. This class of bug has drained more value than any other.
3. Price & oracle manipulation
If your protocol reads a price, assume an attacker can move it within a block. Use time-weighted or multiple oracle sources, sanity-check values, and never trust a spot price from a single pool for anything that matters.
4. Upgradeability & emergency controls
If you use proxies, get the storage layout and initializers right — these are subtle and dangerous. Add a pause switch for emergencies, but make the upgrade path transparent (timelock + multisig) so users aren't exposed to a single rogue key.
5. Tests, fuzzing & coverage
Aim for high coverage with unit tests and fuzz/invariant tests that hammer the edge cases humans miss. A contract without near-complete coverage isn't ready for an audit, let alone mainnet.
6. Independent audit & bug bounty
Bring in a reputable third-party auditor — your own team is blind to its own assumptions. Budget time to actually fix and re-review findings, not just receive a report. After launch, a standing bug bounty turns would-be attackers into paid reporters.
7. Gas & griefing
Optimize hot paths, but not at the expense of clarity or safety. Watch for unbounded loops and external-call patterns that let an attacker make functions too expensive to call. Lean gas is a feature your users feel.
FAQ
Do I need a third-party audit? If your contracts hold real value, yes — and users expect it.
Most common vulnerability? Access-control mistakes and reentrancy, then oracle manipulation in DeFi.
Does an audit guarantee safety? No — it sharply reduces risk, paired with testing, sane upgrades, monitoring, and a bounty.
Shipping a contract soon?
We build, test, and harden smart contracts — and we've taken protocols through independent audits. Book a free consult and we'll pressure-test your plan.