LogoLogo
CtrlK
  • 🔐The Complete Guide to Securing Web3 Protocols
  • Design
    • Design a Gradual Path Towards Immutability
    • Actor-Based Threat Modeling
    • Principle of Least Privilege
    • Implement a Role-Based Access Control (RBAC) Model
    • Design for Funds Isolation
    • Implement Circuit Breakers
    • Global Registry for Project Deployed Smart Contracts
  • Coding
    • Code Conservatism: Less is More
    • Use a Spell Checker
    • Use an Up-To-Date Compiler Version
    • Security-Driven Development
    • Define a Security-Oriented CI Environment
    • Prefer Unstructured Storage for Upgradeable Contracts
    • Avoid Vendoring Dependencies
    • Use a Plugin for Safe Upgrades
    • Use Reentrancy Guards
    • Revert/Return Early
    • Avoid Unlimited ERC-20 Approvals
    • Use the Safe ERC-20 Library
    • Use the SafeCast Library
    • Use Cryptographic Libraries
    • Prefer to Avoid Low-Level Calls
    • Use abi.encodeCall for Low Level Calls
    • Careful Vetting of Unchecked Blocks
    • Avoid Arbitrary Low-Level External Calls
    • Follow the EIP-712 Standard for Digital Signatures
    • Vetting Process for External Tokens
  • Testing
    • Develop Comprehensive Unit Tests
    • Develop Comprehensive Integration Tests
    • Develop Comprehensive Fuzzing Tests
    • Develop Comprehensive Fork Tests
    • Track and Optimize Test Coverage
    • Conduct End-to-End Testing on Testnet
  • Pre-Deployment
    • How to Decide What Type of Security Review Your Project Needs
    • Key Considerations for Setting the Mainnet Deployment Date
    • Conduct an Internal Security Review
    • The Importance of Code Freeze Before an External Security Review
    • Conduct an External Security Review (a.k.a. Audit)
    • Implement Robust Monitoring Security Rules
    • Leverage Security Reviews to Define Tailor-Made Monitoring Rules
    • Establish a Contingency Plan
  • Deployment
    • Adopt a “Soft Launch” Strategy
    • Never Deploy Code That Was Not Reviewed Externally
    • Verify Your Deployed Contracts
    • Launch a Bug Bounty Program
  • Ongoing Upgrades
    • Handling Communications Before a Smart Contract Upgrade
    • Ensure Changes Are Backwards Compatible
    • Use Existing Unit Tests to Prevent Regression Bugs
    • Handling State Migration in a Secure Way
    • Key Considerations for the Security Review of Upgrades
  • Ongoing Operations
    • Establish a Chief of Security Role
    • Establish a Security Council
    • Managing Privileged Accounts Securely
    • Add Regression Tests After Fixing Vulnerabilities
  • Emergency Response
    • Handling a Security Incident
    • Post-Incident Actions
Powered by GitBook
On this page
Export as PDF

Coding

Code Conservatism: Less is MoreUse a Spell CheckerUse an Up-To-Date Compiler VersionSecurity-Driven DevelopmentDefine a Security-Oriented CI EnvironmentPrefer Unstructured Storage for Upgradeable ContractsAvoid Vendoring DependenciesUse a Plugin for Safe UpgradesUse Reentrancy GuardsRevert/Return EarlyAvoid Unlimited ERC-20 ApprovalsUse the Safe ERC-20 LibraryUse the SafeCast LibraryUse Cryptographic LibrariesPrefer to Avoid Low-Level CallsUse abi.encodeCall for Low Level CallsCareful Vetting of Unchecked BlocksAvoid Arbitrary Low-Level External CallsFollow the EIP-712 Standard for Digital SignaturesVetting Process for External Tokens
PreviousGlobal Registry for Project Deployed Smart ContractsNextCode Conservatism: Less is More

Last updated 3 days ago