Reentrancy and calls
External calls should be reviewed in context: token hooks, callbacks, ERC-777 behavior, multicalls, pull payments, and state updates can make a path exploitable.
Access control
Every privileged function needs a clear role, revocation path, and operational owner. Timelocks, multisigs, pausing, upgrades, and emergency functions are part of the security model.
Oracles and MEV
Auditors should check stale prices, decimal conversions, manipulation windows, sequencer downtime, and whether transactions can be reordered or sandwiched.
Proxies and storage
Upgradeable contracts require initialization checks, storage layout discipline, admin separation, implementation locks, and migration plans.
Signatures
Permit, meta-transaction, and account abstraction flows require nonce handling, domain separation, chain IDs, expiry, and replay protection.
Test configuration changes between operations
For a deposit-and-withdraw flow, change a permitted fee, adapter, or pause setting between the two transactions. Check whether the user can still receive the outcome promised by the protocol's rules. Include authorized administrative actions in these tests: a privileged call can be correctly authorized while still breaking an accounting or availability assumption.
Include deployment and integration code
Provide implementation and proxy contracts, initialization scripts, role transfers, adapters, and the intended token behavior. A source review should be tied to the exact deployment configuration. Record which contracts are external dependencies and what guarantees your code expects from them, particularly for callbacks, approvals, pricing, and upgrades.
Discuss Your Audit Scope
Start with your email and a short project description. Technical details can follow. Request a smart contract audit quote or review public CTDSEC audit examples.