LogoLogo
CtrlK
  • 🔐The Complete Guide to Securing Web3 Projects
  • Design
    • Design a Gradual Path Towards Immutability
    • Core/Periphery Design Pattern for Immutable Protocols
    • Actor-Based Threat Modeling
    • Principle of Least Privilege
    • Implement a Role-Based Access Control (RBAC) Model
    • Design for Funds Isolation
    • Implement Circuit Breakers
    • Global Registry for Project Deployed Smart Contracts
  • Coding
    • Code Conservatism: Less is More
    • Use a Spell Checker
    • Use an Up-To-Date Compiler Version
    • Security-Driven Development
    • Define a Security-Oriented CI Environment
    • Prefer Unstructured Storage for Upgradeable Contracts
    • Avoid Vendoring Dependencies
    • Use a Plugin for Safe Upgrades
    • Use Reentrancy Guards
    • Revert/Return Early
    • Revert vs Return
    • Avoid Unlimited ERC-20 Approvals
    • Use the Safe ERC-20 Library
    • Beware of "NFT Front Running" in ERC-721 Tokenization
    • Rounding in Favor of the Protocol with Integer Division in Solidity
    • Use the SafeCast Library
    • Use Cryptographic Libraries
    • Consider Non-Sequential Nonces for Digital Signatures
    • Prefer to Avoid Low-Level Calls
    • Use abi.encodeCall for Low Level Calls
    • Careful Vetting of Unchecked Blocks
    • Avoid Arbitrary Low-Level External Calls
    • Follow the EIP-712 Standard for Digital Signatures
    • Vetting Process for External Tokens
    • Ensure Code Dependencies Are Secured
  • Testing
    • Develop Comprehensive Unit Tests
    • Develop Comprehensive Integration Tests
    • Develop Comprehensive Fuzzing Tests
    • Develop Comprehensive Fork Tests
    • Track and Optimize Test Coverage
    • Conduct End-to-End Testing on Testnet
  • Pre-Deployment
    • How to Decide What Type of Security Review Your Project Needs
    • Key Considerations for Setting the Mainnet Deployment Date
    • Conduct an Internal Security Review
    • The Importance of Code Freeze Before an External Security Review
    • Conduct an External Security Review (a.k.a. Audit)
    • Implement Robust Monitoring Security Rules
    • Leverage Security Reviews to Define Tailor-Made Monitoring Rules
    • Configuration Risk Assessment for DeFi Protocols
    • Conduct an External Web2 Security Review
    • Protect Against DNS Poisoning
    • Conduct a Solvency Assurance Audit
    • Establish a Contingency Plan
  • Deployment
    • Adopt a “Soft Launch” Strategy
    • Never Deploy Code That Was Not Reviewed Externally
    • Verify Your Deployed Contracts
    • Launch a Bug Bounty Program
  • Ongoing Upgrades
    • Handling Communications Before a Smart Contract Upgrade
    • Ensure Changes Are Backwards Compatible
    • Use Existing Unit Tests to Prevent Regression Bugs
    • Handling State Migration in a Secure Way
    • Key Considerations for the Security Review of Upgrades
  • Ongoing Operations
    • Establish a Head of Security Role
    • Establish a Security Council
    • Managing Privileged Accounts Securely
    • Add Regression Tests After Fixing Vulnerabilities
    • Conduct a Web3SOC-Style Review
    • Secure Your Treasury
    • Securing DAOs and DAO Voting
    • Background Checks and Personnel Security for Web3 Projects
    • Protect Against Social Media Takeovers (Twitter, Discord)
    • Protect Against Phishing Attacks
    • Protect Against Denial-of-Service (DoS/DDoS) Attacks
    • Protect Against SIM Swapping
    • Protect Against Credential Stuffing and Account Takeovers
    • Periodically Revoke Permissions to Critical Assets
  • Emergency Response
    • Handling a Security Incident
    • Post-Incident Actions
Powered by GitBook
On this page

Pre-Deployment

How to Decide What Type of Security Review Your Project NeedsKey Considerations for Setting the Mainnet Deployment DateConduct an Internal Security ReviewThe Importance of Code Freeze Before an External Security ReviewConduct an External Security Review (a.k.a. Audit)Implement Robust Monitoring Security RulesLeverage Security Reviews to Define Tailor-Made Monitoring RulesConfiguration Risk Assessment for DeFi ProtocolsConduct an External Web2 Security ReviewProtect Against DNS PoisoningConduct a Solvency Assurance AuditEstablish a Contingency Plan
PreviousConduct End-to-End Testing on TestnetNextHow to Decide What Type of Security Review Your Project Needs

Last updated 1 month ago