Web3 Product Security Checklist

Document who might attack, how, and what is at risk. Drives security decisions.

Audits, bug bounties, and security tools cost money. Budget for them.

Audits take weeks and have waitlists. Schedule early.

GDPR, SOC2, regulatory requirements affect design. Know them early.

Collect only data you need. Less data means less risk.

Decide if contracts can be upgraded. Both choices have tradeoffs.

Who holds admin keys? Multisig? Timelock? Document the plan.

What happens if we find a bug? Pause mechanism? Response plan?

Which contracts need audit? What severity findings are acceptable?

Post-launch security coverage. Budget, scope, and platform decided.

Users understand what they are signing. Clear transaction descriptions.

Official links documented. Verification guidance for users.

Request only needed approvals. Avoid unlimited approvals when possible.

Can users recover if they lose access? What are the limitations?

What do we tell users who get phished? Support documentation ready.

All critical and high findings fixed. Medium findings tracked.

Security researchers can report issues. Rewards ready.

Anomaly detection. Alert when unusual activity occurs.

Who does what if something goes wrong. Contact list ready.

Pre-written templates for security incidents. Faster response.

Consider coverage or reserve fund for security events.

External protocols we depend on. What if they get hacked?

If using price oracles, understand manipulation risks.

Cross-chain bridges are high-risk. Know the security model.

Multiple RPC providers. Fallback if one is down or compromised.

Security is not one-time. Schedule regular reviews.

Keep track of security updates in dependencies.

Process for triaging and responding to reports.

Track security-related metrics. Time to fix, report quality.

Understand oracle trust assumptions and failure modes.

Know risks of any bridges your protocol uses or integrates with.

Document all external APIs. Plan for their failure.

Evaluate security practices of key vendors and partners.

Multiple RPC providers to avoid single point of failure.

Ensure critical metadata is pinned and will persist.