Smart Contract Deployment Checklist

0 of 56 complete (0%)

Final Code Review

Last checks before freezing the code.

All tests passing with 100% of critical paths coveredcritical

Run full test suite. Ensure all edge cases for value transfers and state changes are tested.

Remove all console.log and debug codecritical

Search for console.log, hardhat/console.sol imports, and test-only functions.

Verify correct Solidity versioncritical

Use a stable, audited compiler version. Avoid floating pragmas (^0.8.0).

Check optimizer settingsimportant

Document optimizer runs. Higher runs = cheaper execution, larger bytecode.

Verify contract sizes under 24KBcritical

Check bytecode size limits. Split contracts or use libraries if needed.

Remove unused imports and dead codeimportant

Clean up any code that isn't used in production paths.

Verify NatSpec documentation is completenice-to-have

All public/external functions should have @notice, @param, and @return docs.

Confirm audit findings are resolvedcritical

All critical and high findings must be fixed. Medium issues should be addressed or documented.

Configuration & Parameters

Verify all deployment parameters are correct.

Verify constructor argumentscritical

Double-check all addresses, rates, and configuration values. Use checksummed addresses.

Confirm admin/owner addressescritical

Owner should be a multisig, not an EOA. Verify multisig signers and threshold.

Set appropriate timelock delayscritical

Critical operations should have 24-48 hour timelocks minimum.

Verify oracle addresses and feedscritical

Confirm Chainlink feed addresses are correct for target network.

Check fee parameters and limitscritical

Verify fee percentages, max fees, and fee recipient addresses.

Confirm token addresses and decimalscritical

Verify all token addresses. Check decimals handling for non-18 decimal tokens.

Set initial rate limitsimportant

Configure conservative limits for withdrawals, mints, and other operations.

Document all magic numbersnice-to-have

Every constant should be documented with its meaning and rationale.

Access Control Setup

Configure permissions and privileged roles.

Deploy multisig wallet firstcritical

Create Safe or other multisig with appropriate signers before contract deployment.

Set up role-based access controlcritical

Grant roles to appropriate addresses. Use principle of least privilege.

Configure timelock controllercritical

Deploy timelock and set as admin for upgradeable contracts.

Verify emergency admin setupcritical

Emergency pause should be accessible quickly but protected from abuse.

Document all privileged addressesimportant

Create public documentation of all admin addresses and their capabilities.

Set up monitoring for admin actionsimportant

Configure alerts for all privileged transactions.

Plan key rotation procedureimportant

Document how to rotate keys if a signer is compromised.

Renounce deployer privilegescritical

Transfer ownership and renounce any deployer-specific roles after setup.

Testnet Deployment

Validate deployment on testnet first.

Deploy to testnet with production configcritical

Use identical constructor args and deployment scripts as mainnet.

Run integration tests against testnetcritical

Execute full user flows against deployed testnet contracts.

Test upgrade path on testnetcritical

If upgradeable, test the full upgrade process including storage migration.

Verify with block explorerimportant

Confirm contract verification works and ABI is correct.

Test emergency procedurescritical

Execute pause, emergency withdrawal, and circuit breaker functions.

Test frontend integrationimportant

Verify dapp works correctly with testnet deployment.

Measure gas costsimportant

Record gas usage for all major operations. Optimize if needed.

Test with realistic dataimportant

Simulate production-like conditions including high volumes.

Mainnet Deployment

The actual production deployment.

Choose optimal deployment timeimportant

Deploy during low gas periods. Avoid weekends for critical infrastructure.

Prepare deployment wallet with ETHcritical

Fund deployer with 2-3x expected gas costs. Use fresh wallet.

Execute deployment scriptcritical

Run automated deployment. Never deploy manually transaction by transaction.

Verify all contracts on Etherscancritical

Submit source code verification immediately after deployment.

Record all deployed addressescritical

Document every contract address, transaction hash, and block number.

Verify initialization statecritical

Check all storage variables are correctly initialized.

Execute post-deployment configurationcritical

Set up any remaining parameters that couldn't be set in constructor.

Transfer ownership to multisigcritical

Move admin rights from deployer to production multisig.

Post-Deployment Verification

Confirm everything is working correctly.

Execute smoke tests on mainnetcritical

Run basic operations with small amounts to verify functionality.

Verify contract ownershipcritical

Confirm owner/admin is the intended multisig address.

Check oracle connectionscritical

Verify price feeds are returning correct, fresh data.

Test pause functionalitycritical

Verify pause works and can be triggered by guardian.

Verify event emissionsimportant

Confirm events are emitting correctly for indexers.

Check subgraph indexingimportant

Verify The Graph or other indexers are picking up events.

Test frontend with production contractscritical

Full end-to-end test of dapp with real mainnet contracts.

Document deployment in changelogimportant

Record deployment details, addresses, and any issues encountered.

Monitoring & Alerts

Set up ongoing production monitoring.

Configure transaction monitoringcritical

Set up Tenderly, OpenZeppelin Defender, or similar for tx monitoring.

Set up balance alertscritical

Alert on unusual balance changes or large withdrawals.

Monitor for failed transactionsimportant

Alert on reverted transactions, especially privileged operations.

Set up oracle health monitoringcritical

Alert on stale prices or oracle deviations.

Configure invariant monitoringimportant

Set up Forta bots or custom monitoring for protocol invariants.

Create incident response runbookcritical

Document steps for common incidents: pause, upgrade, fund recovery.

Set up on-call rotationimportant

Ensure someone can respond to alerts 24/7.

Schedule regular security reviewsimportant

Plan periodic audits and security assessments.

Pro Tips

Use deterministic deployments: CREATE2 lets you predict addresses and deploy to the same address across chains.

Always deploy from scripts, never manually: Manual deployments lead to configuration errors. Automated scripts are repeatable and auditable.

Keep deployment private keys offline: Use hardware wallets for deployment. Never store deployer keys on servers.

Deploy during low-activity periods: Tuesday-Thursday, outside US and Asian market hours, typically has lowest gas.

Have a rollback plan: Know exactly what to do if deployment fails halfway. Document recovery steps before starting.

Ready to build your Web3 career?

Browse hundreds of open roles across the decentralized ecosystem.

Explore Jobs