DeFi Code Review Checklist

0 of 56 complete (0%)

Financial Logic Review

Verify correctness of financial calculations.

Verify interest rate calculationscritical

Check compound interest formulas, accrual frequency, and precision handling.

Check exchange rate calculationscritical

Verify share/asset conversions. Look for rounding direction vulnerabilities.

Review fee calculations and distributioncritical

Verify fee percentages, recipients, and collection timing.

Validate collateral ratio mathcritical

Check liquidation thresholds, LTV calculations, and health factor formulas.

Verify reward distribution logiccritical

Check reward accrual, claiming, and vesting calculations.

Check for precision loss in divisionscritical

Review order of operations. Multiply before divide to preserve precision.

Validate slippage calculationscritical

Verify slippage tolerance is applied correctly in swaps.

Review decimal handling for different tokenscritical

Verify handling of 6-decimal (USDC), 8-decimal (WBTC), and 18-decimal tokens.

Oracle Integration

Review price feed usage and manipulation resistance.

Verify oracle staleness checkscritical

Confirm stale price detection with appropriate thresholds per asset.

Check for oracle manipulation vectorscritical

Assess if prices can be manipulated within a single transaction.

Review TWAP implementation if usedcritical

Verify TWAP window is long enough to resist manipulation.

Check fallback oracle logiccritical

Verify behavior when primary oracle fails or returns invalid data.

Verify price decimal normalizationcritical

Ensure oracle prices are correctly scaled for calculations.

Check round ID validation (Chainlink)important

Verify answeredInRound >= roundId for fresh data.

Review price bounds/circuit breakersimportant

Verify extreme price movements trigger protection mechanisms.

Check for oracle front-running risksimportant

Assess if oracle updates create arbitrage or attack opportunities.

Liquidity & Solvency

Verify protocol remains solvent under all conditions.

Check for bad debt scenarioscritical

Verify liquidation incentives ensure positions are closed before underwater.

Review withdrawal queue logiccritical

Check handling of insufficient liquidity for withdrawals.

Verify utilization rate calculationsimportant

Ensure interest rates respond appropriately to utilization.

Check first depositor attack resistancecritical

Verify initial share minting doesn't allow share manipulation.

Review share inflation attackscritical

Check for donation attacks that inflate share value.

Verify reserve factor collectionimportant

Check that protocol reserves are correctly accumulated.

Check for dust attack vectorsimportant

Verify small amounts don't cause DoS or accounting issues.

Review emergency liquidity mechanismsimportant

Verify circuit breakers and emergency withdrawal paths.

MEV & Ordering

Review transaction ordering vulnerabilities.

Identify sandwich attack vectorscritical

Check if user transactions can be profitably sandwiched.

Review frontrunning opportunitiescritical

Identify transactions that leak profitable information.

Check deadline parameter usagecritical

Verify swaps/operations have expiration timestamps.

Verify slippage protectioncritical

Confirm minimum output amounts are enforced correctly.

Review liquidation orderingimportant

Check if liquidation ordering can be gamed for MEV.

Check for JIT liquidity vulnerabilitiesimportant

Assess if just-in-time liquidity can exploit users.

Review backrunning opportunitiesimportant

Identify if large trades create backrunning value.

Consider private mempool usagenice-to-have

For sensitive operations, recommend Flashbots or similar.

Access Control & Governance

Review permission systems and admin functions.

Review all admin-only functionscritical

Verify admin capabilities are documented and limited appropriately.

Check timelock on parameter changescritical

Sensitive parameters should have timelock delays.

Verify role separationimportant

Different functions should require different roles.

Review upgrade mechanismscritical

Check proxy patterns, storage layouts, and upgrade auth.

Check emergency pause functionalitycritical

Verify pause scope, who can trigger, and unpause process.

Review guardian/multisig requirementsimportant

Critical functions should require multiple signers.

Check for centralization risksimportant

Identify single points of failure or excessive admin power.

Verify parameter boundsimportant

Admin-settable parameters should have sensible limits.

Integration Safety

Review external protocol interactions.

Check reentrancy on external callscritical

Verify CEI pattern or reentrancy guards on all external calls.

Review token approval handlingimportant

Check for approval race conditions and infinite approvals.

Verify callback handler securitycritical

If implementing callbacks (flash loans), verify caller validation.

Check for composability assumptionsimportant

Document assumptions about integrated protocols.

Review flash loan integrationcritical

If using flash loans, verify proper repayment and callback security.

Check for read-only reentrancycritical

Verify view functions can't be manipulated via reentrancy.

Verify cross-protocol assumptionsimportant

Check assumptions about external protocol behavior.

Review token standard edge casesimportant

Check handling of fee-on-transfer, rebasing, and non-standard tokens.

Testing & Documentation

Verify code quality and test coverage.

Check test coverage for changescritical

New code should have detailed tests including edge cases.

Verify fuzzing for financial functionsimportant

Mathematical operations should be fuzz tested.

Review integration test scenariosimportant

Complex user flows should have end-to-end tests.

Check invariant testsimportant

Protocol invariants should be tested with property-based tests.

Verify NatSpec documentationimportant

All public functions should have complete documentation.

Review change documentationimportant

PR should explain what changed and why.

Check for gas optimizations needednice-to-have

High-frequency functions should be gas efficient.

Verify event emissionsimportant

State changes should emit appropriate events.

Pro Tips

Always trace the math by hand: For any financial calculation, work through specific examples manually before trusting the code.

Think like an attacker with a flash loan: Ask: What could I do with unlimited capital in a single transaction? This catches most DeFi bugs.

Check edge cases: zero, one, max: Every numeric input should be tested with 0, 1, and type(uint256).max.

Review rounding direction for every division: Rounding should favor the protocol, not users. Inconsistent rounding is exploitable.

Draw the token flow diagram: For complex operations, diagram where tokens move. Missing flows mean lost or stuck funds.

Ready to build your Web3 career?

Browse hundreds of open roles across the decentralized ecosystem.

Explore Jobs