Pre-Audit Checklist

Owner/admin privileges are properly restricted

💡 Use multi-sig or DAO governance for critical functions

Multi-sig or timelock for critical functions

💡 Minimum 2/3 multi-sig recommended for admin keys

Role-based access control implemented

💡 Separate roles for different permission levels

Emergency pause functionality exists

💡 Circuit breaker pattern for quick response to exploits

Mint authority is disabled or controlled

💡 Disabling mint prevents infinite token creation

Freeze authority is disabled or documented

💡 If retained, document the governance process

Token metadata is immutable or controlled

💡 Prevent unauthorized metadata changes

Transfer hooks reviewed for security

💡 Ensure hooks cannot block transfers maliciously

Liquidity is locked for appropriate duration

💡 Minimum 6 months lock recommended

LP tokens are not held by single wallet

💡 Distribute LP tokens to prevent rug pulls

Tokenomics reviewed for sustainability

💡 Ensure emission schedule is realistic

Slippage parameters are reasonable

💡 Max slippage should protect against MEV

No unchecked arithmetic operations

💡 Use Rust's checked_* methods or overflow checks

Reentrancy guards in place

💡 Use mutex patterns for state-changing functions

Integer overflow/underflow protection

💡 Enable overflow checks in Cargo.toml

Proper error handling implemented

💡 Use custom error types with clear messages

Oracle manipulation protections

💡 Use TWAP or multiple oracle sources

Flash loan attack mitigations

💡 Add delays or multi-block confirmations

Cross-program invocation (CPI) validated

💡 Validate all incoming CPI calls

Account validation for all inputs

💡 Verify ownership, type, and state of accounts

Signer checks on all privileged operations

💡 is_signer check on all admin functions

Owner validation for PDAs

💡 Verify program ID owns the PDA

Rent exemption properly handled

💡 Ensure accounts are rent-exempt

Account discriminators implemented

💡 Use Anchor discriminators or manual tagging