Audit Engagement Checklist for Smart Contract Auditors

Document all contracts in scope, lines of code, and expected deliverables. Clarify what's out of scope.

Collect whitepapers, architecture docs, previous audits, and design specifications from the client.

List all oracles, external protocols, and third-party contracts the system interacts with.

Discuss critical properties that must always hold—these become primary audit targets.

Document what roles are trusted, what external systems are trusted, and failure assumptions.

Diagram inheritance relationships and identify diamond/multiple inheritance issues.

Document all privileged roles, their capabilities, and how permissions can change.

Analyze proxy patterns, upgrade timelock, and storage collision risks.

Document all cross-contract calls and potential reentrancy entry points.

Understand token flows, fee mechanisms, and economic invariants.

Analyze price feed sources, staleness handling, and manipulation resistance.

Analyze each entry point for input validation, access control, and state changes.

Follow all value transfers to verify accounting accuracy and prevent fund loss.

Check for overflow/underflow, rounding errors, and precision loss.

Identify unbounded loops that could cause DoS via gas exhaustion.

Verify CEI pattern or reentrancy locks on all external calls.

Execute static analysis tools and triage all findings.

Set up Echidna or Foundry fuzzing with property-based tests.

Attempt price manipulation, governance attacks, and liquidity drainage via flash loans.

Test TWAP effectiveness, multi-oracle fallbacks, and manipulation costs.

Identify sandwich attack vectors, frontrunning opportunities, and backrunning risks.

Verify liquidation thresholds, incentives, and cascade prevention.

Verify deadline parameters, minimum output amounts, and price bounds.

Check first depositor attacks, rounding exploits, and share inflation.

Run integration tests against forked mainnet state with real protocol data.

Test message passing, finality assumptions, and bridge failure handling.

Simulate stale prices, oracle downtime, and manipulation attempts.

Test storage migrations, initialization, and rollback scenarios.

Verify pause mechanisms, emergency withdrawals, and circuit breakers.

Use consistent severity ratings: Critical, High, Medium, Low, Informational.

Provide PoC code or step-by-step instructions to reproduce each finding.

Describe worst-case scenarios, affected users, and potential fund loss.

Suggest specific code changes or architectural improvements.

Have findings reviewed by another auditor before client delivery.

Review all fixes and confirm they address the root cause without introducing new issues.

Mark all findings as Fixed, Partially Fixed, Acknowledged, or Disputed.

Summarize overall security posture, key risks, and recommendations.