Smart contract security checklists and vulnerability guides for Solidity developers. By Blockhertz
- All privileged functions use onlyOwner or role-based access
- No public functions that should be internal or private
- Admin functions protected by multi-sig or timelock
- No tx.origin used for auth (use msg.sender instead)
- State updated BEFORE external calls (Checks-Effects-Interactions pattern)
- ReentrancyGuard on all functions that send ETH or call external contracts
- No cross-function reentrancy vulnerabilities
- Pull payment pattern used for ETH distributions
- Solidity 0.8+ used (built-in checks)
- SafeCast used for type conversions
- No unchecked blocks around arithmetic unless intentional
- No spot prices from single DEX
- Chainlink TWAP used for pricing
- Circuit breakers for abnormal price movements
- Stale price checks implemented
- No governance actions executable in single transaction
- Snapshot-based voting with time locks
- Price calculations not manipulable by flash loans
- All call() return values checked
- No delegatecall to untrusted addresses
- External calls made LAST (after state updates)
- No loops with external calls
- Initializer protected with initializer modifier
- Storage slots not colliding
- Implementation contract initialized to prevent takeover
- Proxy admin secured
- No selfdestruct() in contract
- If needed: protected by multi-sig + timelock
- Events emitted for all state-changing functions
- Indexed parameters on events for efficient filtering
- No hardcoded addresses
- No timestamp dependence for critical logic
- All TODO/FIXME removed
- Test coverage > 95%
- Natspec documentation complete
| Vulnerability | Severity | Guide |
|---|---|---|
| Reentrancy | Critical | Read → |
| Access Control | Critical | Read → |
| Integer Overflow | High | Read → |
| Oracle Manipulation | Critical | Read → |
| Flash Loans | High | Read → |
Run a free AI-powered security audit on your smart contracts:
blockhertz.com/tools/ai-auditor
→ Paste any Solidity, Rust, Move or Vyper contract → Get risk score + findings → Fix recommendations included → No signup required → Results in 60 seconds
- How to Audit a Smart Contract
- Blockhertz vs Slither
- Blockchain Security Statistics 2026
- Smart Contract Security Hub
blockhertz.com — AI-powered blockchain developer tools and Web3 engineering services.
Serving clients worldwide since 2018 🌍