LogoLogo
CtrlK
  • 🔐The Complete Guide to Securing Web3 Projects
  • Design
    • Design a Gradual Path Towards Immutability
    • Core/Periphery Design Pattern for Immutable Protocols
    • Actor-Based Threat Modeling
    • Principle of Least Privilege
    • Implement a Role-Based Access Control (RBAC) Model
    • Design for Funds Isolation
    • Implement Circuit Breakers
    • Global Registry for Project Deployed Smart Contracts
  • Coding
    • Code Conservatism: Less is More
    • Use a Spell Checker
    • Use an Up-To-Date Compiler Version
    • Security-Driven Development
    • Define a Security-Oriented CI Environment
    • Prefer Unstructured Storage for Upgradeable Contracts
    • Avoid Vendoring Dependencies
    • Use a Plugin for Safe Upgrades
    • Use Reentrancy Guards
    • Revert/Return Early
    • Revert vs Return
    • Avoid Unlimited ERC-20 Approvals
    • Use the Safe ERC-20 Library
    • Beware of "NFT Front Running" in ERC-721 Tokenization
    • Rounding in Favor of the Protocol with Integer Division in Solidity
    • Use the SafeCast Library
    • Use Cryptographic Libraries
    • Consider Non-Sequential Nonces for Digital Signatures
    • Prefer to Avoid Low-Level Calls
    • Use abi.encodeCall for Low Level Calls
    • Careful Vetting of Unchecked Blocks
    • Avoid Arbitrary Low-Level External Calls
    • Follow the EIP-712 Standard for Digital Signatures
    • Vetting Process for External Tokens
    • Ensure Code Dependencies Are Secured
  • Testing
    • Develop Comprehensive Unit Tests
    • Develop Comprehensive Integration Tests
    • Develop Comprehensive Fuzzing Tests
    • Develop Comprehensive Fork Tests
    • Track and Optimize Test Coverage
    • Conduct End-to-End Testing on Testnet
  • Pre-Deployment
    • How to Decide What Type of Security Review Your Project Needs
    • Key Considerations for Setting the Mainnet Deployment Date
    • Conduct an Internal Security Review
    • The Importance of Code Freeze Before an External Security Review
    • Conduct an External Security Review (a.k.a. Audit)
    • Implement Robust Monitoring Security Rules
    • Leverage Security Reviews to Define Tailor-Made Monitoring Rules
    • Configuration Risk Assessment for DeFi Protocols
    • Conduct an External Web2 Security Review
    • Protect Against DNS Poisoning
    • Conduct a Solvency Assurance Audit
    • Establish a Contingency Plan
  • Deployment
    • Adopt a “Soft Launch” Strategy
    • Never Deploy Code That Was Not Reviewed Externally
    • Verify Your Deployed Contracts
    • Launch a Bug Bounty Program
  • Ongoing Upgrades
    • Handling Communications Before a Smart Contract Upgrade
    • Ensure Changes Are Backwards Compatible
    • Use Existing Unit Tests to Prevent Regression Bugs
    • Handling State Migration in a Secure Way
    • Key Considerations for the Security Review of Upgrades
  • Ongoing Operations
    • Establish a Head of Security Role
    • Establish a Security Council
    • Managing Privileged Accounts Securely
    • Add Regression Tests After Fixing Vulnerabilities
    • Conduct a Web3SOC-Style Review
    • Secure Your Treasury
    • Securing DAOs and DAO Voting
    • Background Checks and Personnel Security for Web3 Projects
    • Protect Against Social Media Takeovers (Twitter, Discord)
    • Protect Against Phishing Attacks
    • Protect Against Denial-of-Service (DoS/DDoS) Attacks
    • Protect Against SIM Swapping
    • Protect Against Credential Stuffing and Account Takeovers
    • Periodically Revoke Permissions to Critical Assets
  • Emergency Response
    • Handling a Security Incident
    • Post-Incident Actions
Powered by GitBook
On this page

Ongoing Upgrades

Handling Communications Before a Smart Contract UpgradeEnsure Changes Are Backwards CompatibleUse Existing Unit Tests to Prevent Regression BugsHandling State Migration in a Secure WayKey Considerations for the Security Review of Upgrades
PreviousLaunch a Bug Bounty ProgramNextHandling Communications Before a Smart Contract Upgrade

Last updated 1 month ago