Scope and freeze
Confirm the exact repositories, contracts, commit hashes, networks, deployment scripts, tests, documentation, and excluded components. Audit quality drops when code changes while review is underway.
Privilege review
List every owner, admin, role, multisig, timelock, pause, mint, burn, upgrade, and emergency function. Then check whether the permission model matches what users and governance expect.
Value flow
Trace deposits, withdrawals, swaps, borrows, repayments, staking, rewards, fees, and treasury movements. Every balance-changing path should preserve the intended accounting invariant.
External dependencies
Review oracles, bridges, relayers, AMMs, tokens, callbacks, hooks, signatures, and off-chain services. Many vulnerabilities are integration failures rather than single-contract bugs.
Remediation readiness
Plan who will fix issues, how fixes will be tested, how final commits will be verified, and what version of the report will be public.
Build a permissions matrix
For each privileged action, record the actor, the permitted target, the delay, and the maximum effect on assets. Include indirect authority through registries, adapters, and upgrades. Test an account with no permissions and an account with only one limited role. A function being owner-only does not establish that the owner role is restricted to the intended operations.
Turn assumptions into failure tests
Choose a value-changing flow and test a dependency failure at each step. Confirm that the resulting balances and obligations remain consistent. Add repeated operations, zero and small amounts, and changes to configuration between transactions. Keep the expected result explicit so the auditor can distinguish a design decision from an implementation mistake.
Discuss Your Audit Scope
Start with your email and a short project description. Technical details can follow. Request a smart contract audit quote or review public CTDSEC audit examples.