Security · Intermediate

Smart contract security checklist: 20 checks before you deploy

A practical pre-deployment security checklist for Solidity smart contracts covering reentrancy, access control, external calls, arithmetic, upgrades, and operational safety.

Deployed code cannot be patched. This list is the minimum to walk through before pressing Deploy on anything that holds value. Monsmith's audit automates the mechanical items; the judgement items are yours.

External calls

1. Every function follows checks, effects, interactions: validate, update state, then call out.
2. Functions that transfer value use a reentrancy guard or are provably safe without one.
3. Return values of low-level call are checked; transfer and send are not relied on for gas semantics.
4. The contract never assumes a callee is not a contract.

Access control

1. Every state-changing function has an explicit permission model, even if it is "anyone".
2. Ownership transfer is two-step or otherwise protected against typos.
3. Privileged functions are minimal, and a compromised key's blast radius is understood.
4. tx.origin is never used for authorisation.

Arithmetic and data

1. Solidity 0.8 checked arithmetic is on; any unchecked block is justified in a comment.
2. Division happens after multiplication to limit precision loss.
3. Timestamps and block numbers are used only where miner influence does not matter, and block-based durations are avoided on fast chains.
4. Randomness never comes from block data.

Design

1. Every state change emits an event.
2. Loops over unbounded arrays cannot be forced to run out of gas by a user.
3. Front-running is considered for any function whose outcome depends on ordering.
4. External price or data sources are validated; a single oracle is not a single point of failure.

Upgrades and operations

1. If upgradeable: storage layout is append-only and the upgrade authority is a multisig or timelock.
2. A pause or circuit breaker exists for contracts holding significant value.
3. Private keys never appear in source, config, or a browser tab. Deploy through a wallet.
4. The exact deployed bytecode is verified on the explorer against the audited source.

Running the mechanical checks

Paste the contract into monsmith.com/studio and run the audit. It flags reentrancy, missing access control, unchecked calls, dangerous patterns, and gives a risk score with specific suggestions. Treat a clean automated result as the beginning of the review, not the end.