Reentrancy and calls
External calls should be reviewed in context: token hooks, callbacks, ERC-777 behavior, multicalls, pull payments, and state updates can make a path exploitable.
Access control
Every privileged function needs a clear role, revocation path, and operational owner. Timelocks, multisigs, pausing, upgrades, and emergency functions are part of the security model.
Oracles and MEV
Auditors should check stale prices, decimal conversions, manipulation windows, sequencer downtime, and whether transactions can be reordered or sandwiched.
Proxies and storage
Upgradeable contracts require initialization checks, storage layout discipline, admin separation, implementation locks, and migration plans.
Signatures
Permit, meta-transaction, and account abstraction flows require nonce handling, domain separation, chain IDs, expiry, and replay protection.
Next step
Use this guide to improve your scope, then request a review when the contracts, documentation, and tests are ready for a frozen commit audit.