Smart Contract Deployment Checklist

Run full test suite. Ensure all edge cases for value transfers and state changes are tested.

Search for console.log, hardhat/console.sol imports, and test-only functions.

Use a stable, audited compiler version. Avoid floating pragmas (^0.8.0).

Document optimizer runs. Higher runs = cheaper execution, larger bytecode.

Check bytecode size limits. Split contracts or use libraries if needed.

Clean up any code that isn't used in production paths.

All public/external functions should have @notice, @param, and @return docs.

All critical and high findings must be fixed. Medium issues should be addressed or documented.

Double-check all addresses, rates, and configuration values. Use checksummed addresses.

Owner should be a multisig, not an EOA. Verify multisig signers and threshold.

Critical operations should have 24-48 hour timelocks minimum.

Confirm Chainlink feed addresses are correct for target network.

Verify fee percentages, max fees, and fee recipient addresses.

Verify all token addresses. Check decimals handling for non-18 decimal tokens.

Configure conservative limits for withdrawals, mints, and other operations.

Every constant should be documented with its meaning and rationale.

Create Safe or other multisig with appropriate signers before contract deployment.

Grant roles to appropriate addresses. Use principle of least privilege.

Deploy timelock and set as admin for upgradeable contracts.

Emergency pause should be accessible quickly but protected from abuse.

Create public documentation of all admin addresses and their capabilities.

Configure alerts for all privileged transactions.

Document how to rotate keys if a signer is compromised.

Transfer ownership and renounce any deployer-specific roles after setup.

Use identical constructor args and deployment scripts as mainnet.

Execute full user flows against deployed testnet contracts.

If upgradeable, test the full upgrade process including storage migration.

Confirm contract verification works and ABI is correct.

Execute pause, emergency withdrawal, and circuit breaker functions.

Verify dapp works correctly with testnet deployment.

Record gas usage for all major operations. Optimize if needed.

Simulate production-like conditions including high volumes.

Deploy during low gas periods. Avoid weekends for critical infrastructure.

Fund deployer with 2-3x expected gas costs. Use fresh wallet.

Run automated deployment. Never deploy manually transaction by transaction.

Submit source code verification immediately after deployment.

Document every contract address, transaction hash, and block number.

Check all storage variables are correctly initialized.

Set up any remaining parameters that couldn't be set in constructor.

Move admin rights from deployer to production multisig.

Run basic operations with small amounts to verify functionality.

Confirm owner/admin is the intended multisig address.

Verify price feeds are returning correct, fresh data.

Verify pause works and can be triggered by guardian.

Confirm events are emitting correctly for indexers.

Verify The Graph or other indexers are picking up events.

Full end-to-end test of dapp with real mainnet contracts.

Record deployment details, addresses, and any issues encountered.

Set up Tenderly, OpenZeppelin Defender, or similar for tx monitoring.

Alert on unusual balance changes or large withdrawals.

Alert on reverted transactions, especially privileged operations.

Alert on stale prices or oracle deviations.

Set up Forta bots or custom monitoring for protocol invariants.

Document steps for common incidents: pause, upgrade, fund recovery.

Ensure someone can respond to alerts 24/7.

Plan periodic audits and security assessments.