Smart Contract Security Checklist for Solidity Developers

View functions called by other protocols can return stale data during reentrancy. Mark state-changing functions appropriately.

If your contract interacts with arbitrary ERC-20s, ensure you're protected against ERC-777 callbacks.

onERC721Received and onERC1155Received can be reentrancy vectors. Protect accordingly.

If your contract can be called within a flashloan, ensure all invariants hold within a single transaction.

Where possible, let users withdraw funds rather than pushing to them automatically.

Validate that critical addresses (owner, admin, fee recipient) cannot be set to address(0).

Add time delays for critical admin functions to give users time to react.

Write tests that verify unauthorized users cannot access restricted functions.

Order operations to minimize precision loss: multiply before divide.

Ensure array access uses valid indices, especially with user-supplied indices.

Verify fallback/receive functions don't accidentally catch intended function calls.

If using deadlines, ensure block.timestamp comparisons are correct (< vs <=).

Use OpenZeppelin's ECDSA library which handles signature malleability.

Use .call{gas: X}() to prevent called contracts from consuming all gas.

Ensure no operation can exceed block gas limit, making the contract unusable.

Use commit-reveal or private mempools for operations sensitive to ordering.

Ensure fee percentages don't overflow and are capped at reasonable values.

Fuzz test with type(uint256).max and 0 to catch edge cases.

Analyze if any actor has incentive to act maliciously. Design for adversarial conditions.

Use 'forge coverage' to ensure all code paths are tested.

Publish source code on Etherscan for transparency.

Create runbooks for pausing, upgrading, and recovering from incidents.

Configure alerts for unusual activity using Tenderly, Forta, or OpenZeppelin Defender.

Set up an Immunefi bounty to incentivize responsible disclosure.