Free · Printable · Not an audit

Audit Readiness Checklist

Use this before you book (or while you wait for) a formal audit. Check what you can verify today. Unchecked items are homework — not a reason to skip a real audit when capital is at risk.

1. Access control

Every privileged function has an explicit modifier / role check (not only “assumed” caller).

Owner / admin / role holders are documented; default admin is not a hot EOA you use daily.

Critical actions (upgrade, pause, mint, sweep) require multi-sig or timelock where appropriate.

No public or incorrectly permissioned initialize, set*, or rescue functions.

Renounce / transfer ownership paths are intentional and tested.

2. Upgradeability & proxies

If upgradeable: proxy pattern named (UUPS / Transparent / Beacon) and justified in docs.

Initializer is protected; implementation cannot be initialized by an attacker.

Storage layout / gaps reviewed for upgrade collisions; no packing surprises across versions.

Upgrade authority and process documented (who, delay, emergency path).

If not upgradeable: immutability is explicit — no accidental proxy or delegatecall surface.

3. Oracle & external assumptions

Price / data sources listed; staleness, decimals, and failure modes documented.

Spot price alone is not used for critical valuation without acknowledging manipulation risk.

External calls (DEX, bridges, registries) have return-value checks and failure handling.

Assumptions about token behavior (fee-on-transfer, rebasing, ERC777 hooks) are written down.

4. Reentrancy & CEI

Checks-Effects-Interactions followed on value-moving paths; state updated before external calls.

ReentrancyGuard (or equivalent) on functions that need it — and you know why.

Cross-function and cross-contract reentrancy considered.

ETH / ERC20 receive hooks and callbacks (e.g. ERC777, flash loans) accounted for.

5. Authorization & signatures

msg.sender vs tx.origin: no reliance on tx.origin for auth.

Permit / EIP-712: domain separator, nonce, deadline, and chainId handled correctly.

Signature replay across contracts / chains considered.

Pull-over-push for token transfers where users could grief or brick accounting.

6. Tests & Foundry coverage

Unit tests for happy path and auth failures, edge amounts, and pause/upgrade paths.

Target: meaningful branch coverage on critical modules (aim ≥80% on core paths; 100% on auth).

Invariant / fuzz tests on accounting invariants (shares, balances, solvency).

Fork tests against Base (or target chain) for integrations you depend on.

forge test / CI green on the commit you will hand to auditors.

7. Documentation for auditors

README: system overview, trust model, privileged roles, external dependencies.

Scope list: in-scope contracts, out-of-scope, known issues, deferred items.

NatSpec on public/external interfaces; non-obvious invariants documented.

Deploy / upgrade scripts and expected addresses documented.

Prior reviews, bug bounty notes, or design changes since last review attached.

8. Common footguns

Unchecked external call return values; silent failures on ERC20 transfer/approve.

Integer / rounding that favors the protocol against users (or vice versa) without docs.

Unsafe delegatecall, arbitrary call targets, or user-controlled calldata to sensitive callees.

Front-running / sandwich surfaces on sensitive state changes (if relevant to your product).

Centralization risks labeled honestly (single admin, upgrade key, pause).

Compiler version pinned; known optimizer / version caveats reviewed.

Want a second set of eyes before the audit invoice?

Fortis Ready’s Focused Contract Readiness Review ($299 / 300 USDC on Base, 48–72h) is a fixed-scope engineering pass — explicitly not a formal audit. Ideal when you have ≤ ~300 nSLOC / 1 contract and an audit window inside ~8 weeks.

Start intake →

Or email info@isuru.dev

Not a formal security audit. This checklist is educational. Completing it does not mean your contracts are safe. Fortis Ready provides readiness feedback only — no guarantees, certifications, or custody. Smart contract deployment can result in total loss of funds. © 2026 Fortis Ready