Scope and freeze
Confirm the exact repositories, contracts, commit hashes, networks, deployment scripts, tests, documentation, and excluded components. Audit quality drops when code changes while review is underway.
Privilege review
List every owner, admin, role, multisig, timelock, pause, mint, burn, upgrade, and emergency function. Then check whether the permission model matches what users and governance expect.
Value flow
Trace deposits, withdrawals, swaps, borrows, repayments, staking, rewards, fees, and treasury movements. Every balance-changing path should preserve the intended accounting invariant.
External dependencies
Review oracles, bridges, relayers, AMMs, tokens, callbacks, hooks, signatures, and off-chain services. Many vulnerabilities are integration failures rather than single-contract bugs.
Remediation readiness
Plan who will fix issues, how fixes will be tested, how final commits will be verified, and what version of the report will be public.
Next step
Use this guide to improve your scope, then request a review when the contracts, documentation, and tests are ready for a frozen commit audit.