LogoLogo
CtrlK
  • 🔐The Complete Guide to Securing Web3 Protocols
  • Design
    • Design a Gradual Path Towards Immutability
    • Actor-Based Threat Modeling
    • Principle of Least Privilege
    • Implement a Role-Based Access Control (RBAC) Model
    • Design for Funds Isolation
    • Implement Circuit Breakers
    • Global Registry for Project Deployed Smart Contracts
  • Coding
    • Code Conservatism: Less is More
    • Use a Spell Checker
    • Use an Up-To-Date Compiler Version
    • Security-Driven Development
    • Define a Security-Oriented CI Environment
    • Prefer Unstructured Storage for Upgradeable Contracts
    • Avoid Vendoring Dependencies
    • Use a Plugin for Safe Upgrades
    • Use Reentrancy Guards
    • Revert/Return Early
    • Avoid Unlimited ERC-20 Approvals
    • Use the Safe ERC-20 Library
    • Use the SafeCast Library
    • Use Cryptographic Libraries
    • Prefer to Avoid Low-Level Calls
    • Use abi.encodeCall for Low Level Calls
    • Careful Vetting of Unchecked Blocks
    • Avoid Arbitrary Low-Level External Calls
    • Follow the EIP-712 Standard for Digital Signatures
    • Vetting Process for External Tokens
  • Testing
    • Develop Comprehensive Unit Tests
    • Develop Comprehensive Integration Tests
    • Develop Comprehensive Fuzzing Tests
    • Develop Comprehensive Fork Tests
    • Track and Optimize Test Coverage
    • Conduct End-to-End Testing on Testnet
  • Pre-Deployment
    • How to Decide What Type of Security Review Your Project Needs
    • Key Considerations for Setting the Mainnet Deployment Date
    • Conduct an Internal Security Review
    • The Importance of Code Freeze Before an External Security Review
    • Conduct an External Security Review (a.k.a. Audit)
    • Implement Robust Monitoring Security Rules
    • Leverage Security Reviews to Define Tailor-Made Monitoring Rules
    • Establish a Contingency Plan
  • Deployment
    • Adopt a “Soft Launch” Strategy
    • Never Deploy Code That Was Not Reviewed Externally
    • Verify Your Deployed Contracts
    • Launch a Bug Bounty Program
  • Ongoing Upgrades
    • Handling Communications Before a Smart Contract Upgrade
    • Ensure Changes Are Backwards Compatible
    • Use Existing Unit Tests to Prevent Regression Bugs
    • Handling State Migration in a Secure Way
    • Key Considerations for the Security Review of Upgrades
  • Ongoing Operations
    • Establish a Chief of Security Role
    • Establish a Security Council
    • Managing Privileged Accounts Securely
    • Add Regression Tests After Fixing Vulnerabilities
  • Emergency Response
    • Handling a Security Incident
    • Post-Incident Actions
Powered by GitBook
On this page
Export as PDF

Ongoing Operations

Establish a Chief of Security RoleEstablish a Security CouncilManaging Privileged Accounts SecurelyAdd Regression Tests After Fixing Vulnerabilities
PreviousKey Considerations for the Security Review of UpgradesNextEstablish a Chief of Security Role

Last updated 3 days ago