DeFi Security Checklist for Developers

0 of 40 complete (0%)

Oracle Security

Protect against price manipulation and oracle failures.

Use TWAP or manipulation-resistant oraclescritical

Avoid spot prices from DEXes. Use Chainlink, time-weighted averages, or other manipulation-resistant sources.

Implement oracle staleness checkscritical

Reject prices older than acceptable threshold. Include updatedAt timestamp validation.

Add oracle fallback mechanismsimportant

If primary oracle fails, have a secondary source or safe fallback behavior.

Validate oracle price boundsimportant

Reject prices that deviate too far from expected ranges to catch oracle manipulation.

Check oracle decimals handlingimportant

Chainlink feeds have different decimals. Normalize all price feeds to consistent precision.

Protect against oracle front-runningimportant

Consider commit-reveal or other mechanisms if oracle updates create arbitrage opportunities.

Flash Loan Protection

Defend against atomic manipulation attacks.

Use TWAP instead of spot pricescritical

Flash loans cannot manipulate time-weighted averages. Never rely on single-block spot prices.

Add deposit/withdraw delays where neededimportant

For governance or rewards, consider requiring deposits to be present for multiple blocks.

Check same-block deposit-and-action restrictionsimportant

Prevent users from depositing and taking action (voting, claiming) in the same block.

Validate share price manipulation resistancecritical

Vault share prices should not be manipulable by large deposits/withdrawals in single transactions.

Consider flash loan fees in arbitrage calculationsimportant

Understand that attackers pay fees. Some attacks are unprofitable after fees.

Liquidity Pool Security

For AMMs and liquidity protocols.

Verify constant product/sum invariant maintainedcritical

After every operation, the pool invariant must hold. Test edge cases thoroughly.

Protect against sandwich attacksimportant

Implement slippage protection and consider private transaction submission options.

Check minimum liquidity requirementscritical

First LP should lock minimum liquidity to prevent share price manipulation.

Validate fee calculation accuracyimportant

Fees must be calculated correctly in all scenarios including edge cases.

Test imbalanced pool scenariosimportant

Verify behavior when pools become highly imbalanced or near-empty.

Check LP token mint/burn accountingcritical

LP tokens must accurately represent share of pool. No inflation or deflation bugs.

Lending Protocol Security

For lending and borrowing protocols.

Verify health factor calculationscritical

Health factor must be calculated correctly including all positions and proper oracle prices.

Check liquidation thresholds and incentivescritical

Liquidation must be profitable enough to incentivize liquidators but not excessive.

Protect against bad debt scenarioscritical

Have mechanisms to handle underwater positions where debt exceeds collateral.

Verify interest rate modelimportant

Interest accrual must be calculated correctly. Test with various utilization levels.

Check borrow cap enforcementimportant

Borrow limits must be enforced to prevent protocol insolvency.

Test partial liquidation scenariosimportant

Partial liquidations must leave positions in valid state or fully liquidate.

Vault and Yield Security

For vaults, yield aggregators, and staking.

Protect against first depositor attackcritical

Send small amount to vault on deployment or implement virtual shares to prevent share inflation attack.

Validate share price calculationscritical

Share price must accurately reflect underlying assets. Check for rounding attacks.

Check donation attack resistanceimportant

Donating tokens to vault should not unfairly benefit or harm depositors.

Verify withdrawal queue handlingimportant

If using withdrawal queues, ensure fair processing and no front-running.

Check yield strategy risksimportant

Understand and document risks of underlying yield sources. Implement loss limits.

Implement emergency withdrawalimportant

Users should be able to withdraw in emergencies even if it means forfeiting some yield.

Token Integration Security

Handle edge cases with various token implementations.

Use SafeERC20 for all token transferscritical

Some tokens don't return bool. SafeERC20 handles these edge cases.

Handle fee-on-transfer tokensimportant

Calculate actual received amount after transfer, not the transfer amount.

Handle rebasing tokensimportant

Account for balance changes between transactions for tokens like stETH.

Check token decimal handlingcritical

Normalize calculations for tokens with different decimals (USDC has 6, DAI has 18).

Verify approval patternsimportant

Use increaseAllowance/decreaseAllowance or reset to zero first for tokens with approval race conditions.

Handle tokens with blocklistsimportant

USDC and USDT can blocklist addresses. Consider implications for your protocol.

Economic Security

Protect against economic exploits and incentive manipulation.

Model economic attackscritical

Think through how an attacker with unlimited capital could exploit your protocol.

Verify fee and reward mathcritical

All fee distributions must sum correctly. No funds should be lost or created.

Check for MEV extraction opportunitiesimportant

Identify where sandwich attacks, front-running, or back-running could harm users.

Validate incentive alignmentimportant

Ensure all protocol participants are incentivized to behave honestly.

Test extreme market conditionsimportant

Simulate behavior during high volatility, black swan events, and market crashes.

Pro Tips

Always get an audit before mainnet deployment. DeFi protocols are high-value targets.

Study past exploits deeply. Most new exploits are variations of known attack patterns.

Deploy to mainnet with limited caps first. Increase limits as the protocol proves itself.

Set up monitoring and alerts for unusual activity. Early detection limits damage.

Have an incident response plan ready before you need it. Know who to call and what to do.

Ready to build your Web3 career?

Browse hundreds of open roles across the decentralized ecosystem.

Explore Jobs