Freeze the scope
Choose the exact commit that should be audited. If the team continues changing code, use a clear branch strategy so auditors know which version is authoritative.
Write the threat model
Document assets at risk, privileged roles, external integrations, expected invariants, emergency actions, oracle assumptions, and areas where the team already has concerns.
Make tests useful
Include unit tests, invariant tests, integration tests, deployment scripts, and known failing cases. Tests do not replace manual review, but they help auditors reproduce and validate findings.
Share operational details
Auditors need to understand multisigs, timelocks, deployment ownership, upgrade procedures, monitoring, and incident response because those choices affect real-world risk.
Next step
Use this guide to improve your scope, then request a review when the contracts, documentation, and tests are ready for a frozen commit audit.