Can anyone tell me the steps or points required to audit the smart contract? I want to audit a smart contact and i need checklist for that.


6 Answers 6


You'll find some there :


CEO of Solidified here.

Most audit companies will require the following:

1) Spec of Intended Behavior

This is a written technical specification of how your contracts should work. For tokensales:

  • list of contracts to be audited
  • type of sale/auction
  • hard cap/soft cap
  • exchange rate
  • min/max contribution
  • length of each stage of the sale (time limits for presale, sale, etc.)
  • which functions are intended to be controlled by the owner and other privileged roles (i.e. manual progressing through stages of tokensale, enabling refunds, pausing the tokensale, burning of tokens)
  • is the token intended to be compatible with any standard, like ERC20
  • any vesting logic
  • bonus structure
  • whitelist functionality if exists
  • specify edge cases - i.e. refunds: supposed to give change back when send too much money? What happens when: 1) doesn’t reach soft cap, 2) overreach the limit
  • token minting mechanics. when is it supposed to stop minting?
  • token burning mechanics
  • Re-use of other contacts and their versions.
  • A contract-by-contract description writeup
  • Known weaknesses
  • What's out of scope

For more complex contracts, we also ask for a function-by-function overview and a state flow diagram.

2) Finalized code with access to github repository

You need to have your smart contract code frozen before you begin the audit. No changes are allowed to be made during the audit or they null out the audit work. We often note the commit hash auditors are reviewing in the audit report to avoid misunderstanding.

Additionally, it is very useful to have access to the github repository of the client, not just the code of the contracts, because often questions come up during the audit regarding the deployment, compiler version used and other things.

3) Be at least 2-3 weeks away from your project launch

The process is broken into 3 stages:

  1. Initial Audit Report

  2. Client fixes discovered issues and performs a re-audit.

  3. Contract is posted on Bug bounty.

You need to allow time for all 3 stages to complete before your project goes live.

Additional notes:

You will need to have your devs on standby during the audit process, better yet provide a common communication channel such as Slack, where auditors can easily reach out to devs for clarifications during the audit process.

You will likely need ETH to pay for the audit. Many audit firms do not take other tokens or fiat for compensation.

  • Will downvote because this is a marketing post and not an answer. Contains nothing of substance.
    – Nico
    Commented Mar 21, 2018 at 12:40
  • 1
    I think it's helpful when actual industry players give you real-world guidance. I listed 3 most common items we see clients do not possess when they request an audit with us. Sure, you can go into details about testing, best practices and various philosophies on auditing already pre-deployed code, but in practice not having these 3 bullets will preclude most contract authors from getting a proper audit done. The rest can be negotiated. Regarding substance, I disagree - I provided specific examples of SIB for tokensales and custom systems, as well as timeline and proper process explanation. Commented Mar 22, 2018 at 13:55

Excellent article about preparing for a smart contract audit here, too.


Basicly go over the possible exploits like re-entrancy, overflow/Underflow attacks, ...

For this refer to security considerations in the docs: http://solidity.readthedocs.io/en/v0.4.21/security-considerations.html

And Common patterns: http://solidity.readthedocs.io/en/v0.4.21/common-patterns.html

If you want to learn more about smart contract security and possible expoits make sure to check out the interactive smart contract 'hacking' game from the guys at Zeppelin. They have recently added new ones in: https://ethernaut.zeppelin.solutions/


You can read this article from HashExs' medium blog. They are making audit reports for ICO projects. Also you will find there some examples of audits in their blog.


Please check smart contract audit checklist for 2021 https://blog.quillhash.com/2021/01/18/smart-contract-audit-checklist-for-2021-by-quillaudits-defi/

The rise of Decentralized Finance is inevitable. The DeFi market is growing at an incredibly exponential rate.

However, this year has quite clearly proved that it’s indispensable to consider the best security practices while developing the Smart Contract or building an entire Decentralized Application with so much at stake.

Most importantly, it’s high time for us to understand that Smart Contract Audits can no more be neglected.

With a significant dependency on smart contracts, DeFi audits become crucial where a third party reviews every line of code and helps to identify the bugs and bottlenecks.

If left unaudited, the DeFi contracts may result in setbacks that include loss of funds and manipulation of the system. Sometimes, it may also lead to the shutdown of the company.

Therefore, it becomes necessary to check the team’s quality auditing your DeFi contract and get acquainted with their auditing process

Not the answer you're looking for? Browse other questions tagged or ask your own question.