An audit reviews a defined version of a system within an agreed scope. It does not guarantee that every vulnerability has been found. Ethereum’s security guidance treats independent review as part of a wider process that includes testing and secure development.
Know what was reviewed
Record the contract version, dependencies, and assumptions covered by the review. Changes after that point can introduce new behaviour. Keep deployment records connected to the reviewed source.
Review privileged access
Write down who can mint, pause, upgrade, or change configuration. Review those permissions alongside the code. An operational checklist should include how access is granted, removed, and recovered.
Test the assumptions
Include unexpected inputs and failure cases in testing. Review interactions with external contracts, data sources, and administrative controls. A test passing under normal conditions provides limited information about those boundaries.
Prepare the response
Assign responsibility for monitoring and incident response. Agree on how the team will investigate a suspected issue and communicate decisions. Revisit the review scope when the system changes.
References
Primary documentation used for this article. Product features and pricing can change.
