I’m currently in the process of hiring a dev to develop my token and my smartcontract and deploy it.
Will he need my ETH private key to do it ? Can he change the destination of the funds once the contract is deployed ?
Ethereum Stack Exchange is a question and answer site for users of Ethereum, the decentralized application platform and smart contract enabled blockchain. It only takes a minute to sign up.Sign up to join this community
Ethereum is a general-purpose platform and Solidity is an expressive language, so things can potentially work according to arbitrary rules that your developer codifies. That means both intent and quality need to be aligned in your own best interests and the interests of your users.
It is challenging to confirm either intent or quality unless you are an expert who can review the code. A solution to that problem is a software audit by an independent third party. This is best practice since it gives investors and participants evidence that the system is trustworthy, i.e. it reliably does what it is supposed to do.
The deployment process itself is also a security-oriented topic. It can, for example, consist of the developer deploying the system and then transferring control to your secure hardware wallet, or even relinquishing control so that no one has any special privilege. "Can" because it is possible and usually desirable, but not automatic or something to take for granted.
Have a look at this to gain a sense of what an audit report should look like: https://www.smartcontractaudits.com/audit-provider/solidified/
Hope it helps.