DeFi Protocol Launch Checklist | Hashtag Web3

0 of 64 complete

Security Preparation

Complete security review before launch.

Complete professional security auditcritical

Engage reputable audit firm. Allow 4-8 weeks for thorough review.

Fix all critical and high audit findingscritical

No launch with unresolved critical issues. Document any accepted risks.

Run bug bounty programcritical

Launch on Immunefi or similar. Set meaningful bounty amounts.

Complete formal verification for core functionsimportant

Use Certora, Halmos, or similar for critical invariants.

Run extensive fuzzing campaignscritical

Echidna/Foundry fuzzing for all financial operations.

Review all external dependenciesimportant

Audit imported libraries. Check for known vulnerabilities.

Conduct economic security reviewcritical

Model attack economics, MEV, and manipulation vectors.

Set up security monitoringcritical

Configure Forta bots, Tenderly alerts, or custom monitoring.

Protocol Configuration

Set conservative launch parameters.

Set conservative initial parameterscritical

Lower TVL caps, higher collateral ratios, wider spreads for launch.

Configure asset listings carefullycritical

Start with battle-tested assets (ETH, USDC). Add riskier assets later.

Set supply and borrow capscritical

Limit exposure per asset until protocol is battle-tested.

Configure oracle feedscritical

Use Chainlink primary with fallbacks. Set staleness thresholds.

Set liquidation incentivescritical

Ensure liquidators are profitable to maintain solvency.

Configure interest rate modelscritical

Set utilization targets and rate curves appropriately.

Set fee parametersimportant

Configure protocol fees, withdrawal fees, and distribution.

Configure governance timelockcritical

Set appropriate delay (24-48h minimum) for parameter changes.

Access Control Setup

Secure admin functions and keys.

Deploy governance multisigcritical

Use Gnosis Safe with reputable signers. Document threshold.

Transfer ownership to multisigcritical

Move all admin rights from deployer to governance.

Configure emergency guardiancritical

Set up fast-response guardian for pause functionality.

Document all privileged rolesimportant

Public documentation of who controls what.

Set up key ceremony for critical keysimportant

Proper key generation with multiple witnesses.

Configure upgrade authoritycritical

Set timelock as upgrade admin for proxies.

Test emergency procedurescritical

Dry run pause, unpause, and emergency actions.

Plan key rotation proceduresimportant

Document how to rotate signers if needed.

Liquidity Bootstrapping

Seed initial protocol liquidity.

Plan liquidity bootstrapping strategycritical

Choose LBP, fair launch, liquidity mining, or VC seeding.

Secure initial liquidity commitmentscritical

Line up launch liquidity from team, investors, or partners.

Design liquidity incentive programimportant

Structure rewards to attract sticky liquidity, not mercenary.

Set up liquidity mining contractsimportant

Deploy and test reward distribution contracts.

Coordinate with DEX aggregatorsimportant

List on 1inch, Paraswap, etc. for discoverability.

Plan trading pair strategyimportant

Prioritize deep liquidity for key pairs.

Set up token vesting if applicableimportant

Configure vesting schedules for team and investors.

Prepare treasury managementimportant

Plan how protocol-owned liquidity will be managed.

Infrastructure & Monitoring

Set up operational infrastructure.

Deploy and index subgraphcritical

The Graph or custom indexer for protocol analytics.

Set up protocol dashboardcritical

Real-time TVL, utilization, and health metrics.

Configure liquidation botscritical

Run redundant liquidation bots or partner with liquidators.

Set up keeper infrastructureimportant

Automated keepers for oracle updates, rewards, etc.

Configure alerting systemcritical

PagerDuty or similar for critical alerts.

Set up 24/7 on-call rotationcritical

Ensure someone can respond to incidents anytime.

Deploy frontend to reliable hostingcritical

CDN with DDoS protection. Consider IPFS backup.

Configure RPC redundancycritical

Multiple RPC providers with automatic failover.

Documentation & Communication

Prepare launch communications.

Publish comprehensive docscritical

Protocol mechanics, risks, and user guides.

Write risk disclosurecritical

Clear documentation of protocol risks for users.

Prepare audit report publicationimportant

Make audit reports easily accessible.

Create integration documentationimportant

SDK docs, contract addresses, and integration guides.

Brief community moderatorsimportant

Train mods on protocol mechanics and common issues.

Prepare launch announcementsimportant

Blog posts, tweets, and press materials ready.

Set up support channelsimportant

Discord support, FAQ, and escalation paths.

Coordinate launch PRimportant

Reach out to media, influencers, and partners.

Launch Execution

Execute the mainnet launch.

Final testnet validationcritical

Complete end-to-end testing on testnet fork of mainnet.

Deploy contracts to mainnetcritical

Execute deployment scripts. Verify all contracts.

Seed initial liquiditycritical

Deploy committed liquidity before opening to public.

Enable deposits with capscritical

Start with conservative caps. Raise as confidence grows.

Monitor first transactions closelycritical

Watch initial deposits, borrows, and trades for issues.

Verify oracle functionalitycritical

Confirm price feeds are working correctly.

Test emergency pausecritical

Verify pause functionality works without affecting funds.

Announce launchimportant

Publish announcements once system is stable.

Post-Launch Operations

Ongoing operations after launch.

Monitor protocol health dailycritical

Check TVL, utilization, bad debt, and anomalies.

Gradually raise capsimportant

Increase limits as protocol proves stability.

Process bug bounty submissionscritical

Triage and respond to security reports quickly.

Maintain community communicationimportant

Regular updates on metrics, roadmap, and issues.

Plan next asset listingsimportant

Due diligence on new assets before adding.

Schedule follow-up auditsimportant

Plan audits for new features and periodic reviews.

Gather user feedbackimportant

Collect feedback for product improvements.

Document lessons learnednice-to-have

Record what worked and what to improve.

Tips from the field

1.
Launch with lower caps than you think you need: You can always raise caps. You can't undo a hack. Start conservative.
2.
Have war room ready for launch week: Engineering, security, and ops should be available 24/7 for the first week.
3.
Partner with professional liquidators: Don't rely solely on your own bots. Liquidation failures cause bad debt.
4.
Monitor competitor incidents: When similar protocols get hacked, review if you're vulnerable to the same attack.
5.
Build relationships with security researchers: White hats who know your protocol can spot issues before black hats do.

Join teams building the financial rails of the decentralized economy.