LogoLogo
CtrlK
  • 🔐The Complete Guide to Securing Web3 Protocols
  • Design
    • Design a Gradual Path Towards Immutability
    • Actor-Based Threat Modeling
    • Principle of Least Privilege
    • Implement a Role-Based Access Control (RBAC) Model
    • Design for Funds Isolation
    • Implement Circuit Breakers
    • Global Registry for Project Deployed Smart Contracts
  • Coding
    • Code Conservatism: Less is More
    • Use a Spell Checker
    • Use an Up-To-Date Compiler Version
    • Security-Driven Development
    • Define a Security-Oriented CI Environment
    • Prefer Unstructured Storage for Upgradeable Contracts
    • Avoid Vendoring Dependencies
    • Use a Plugin for Safe Upgrades
    • Use Reentrancy Guards
    • Revert/Return Early
    • Avoid Unlimited ERC-20 Approvals
    • Use the Safe ERC-20 Library
    • Use the SafeCast Library
    • Use Cryptographic Libraries
    • Prefer to Avoid Low-Level Calls
    • Use abi.encodeCall for Low Level Calls
    • Careful Vetting of Unchecked Blocks
    • Avoid Arbitrary Low-Level External Calls
    • Follow the EIP-712 Standard for Digital Signatures
    • Vetting Process for External Tokens
  • Testing
    • Develop Comprehensive Unit Tests
    • Develop Comprehensive Integration Tests
    • Develop Comprehensive Fuzzing Tests
    • Develop Comprehensive Fork Tests
    • Track and Optimize Test Coverage
    • Conduct End-to-End Testing on Testnet
  • Pre-Deployment
    • How to Decide What Type of Security Review Your Project Needs
    • Key Considerations for Setting the Mainnet Deployment Date
    • Conduct an Internal Security Review
    • The Importance of Code Freeze Before an External Security Review
    • Conduct an External Security Review (a.k.a. Audit)
    • Implement Robust Monitoring Security Rules
    • Leverage Security Reviews to Define Tailor-Made Monitoring Rules
    • Establish a Contingency Plan
  • Deployment
    • Adopt a “Soft Launch” Strategy
    • Never Deploy Code That Was Not Reviewed Externally
    • Verify Your Deployed Contracts
    • Launch a Bug Bounty Program
  • Ongoing Upgrades
    • Handling Communications Before a Smart Contract Upgrade
    • Ensure Changes Are Backwards Compatible
    • Use Existing Unit Tests to Prevent Regression Bugs
    • Handling State Migration in a Secure Way
    • Key Considerations for the Security Review of Upgrades
  • Ongoing Operations
    • Establish a Chief of Security Role
    • Establish a Security Council
    • Managing Privileged Accounts Securely
    • Add Regression Tests After Fixing Vulnerabilities
  • Emergency Response
    • Handling a Security Incident
    • Post-Incident Actions
Powered by GitBook
On this page
Export as PDF

Pre-Deployment

How to Decide What Type of Security Review Your Project NeedsKey Considerations for Setting the Mainnet Deployment DateConduct an Internal Security ReviewThe Importance of Code Freeze Before an External Security ReviewConduct an External Security Review (a.k.a. Audit)Implement Robust Monitoring Security RulesLeverage Security Reviews to Define Tailor-Made Monitoring RulesEstablish a Contingency Plan
PreviousConduct End-to-End Testing on TestnetNextHow to Decide What Type of Security Review Your Project Needs

Last updated 3 days ago