EVM General Security Checklist

Multi-sig thresholds, validator rotation, slashing conditions, Byzantine fault tolerance

Message authentication, replay prevention, ordering guarantees, timeout mechanisms

Supply conservation, mint authority controls, burn proof verification

Rebalancing mechanisms, slippage protection, pool insolvency

Price feed accuracy across chains, manipulation resistance, failover mechanisms

Relayer incentives, censorship resistance, delivery guarantees

Pause mechanisms, volume limits, velocity controls, emergency governance

Endpoint configuration, trusted remote setup, lzReceive safety

Router configuration, ccipReceive implementation, fee handling

TWAP oracles, flash loan resistance, sandwich attack prevention

Constant product formula, concentrated liquidity calculations, fee accrual

Minimum output checks, deadline parameters, price impact limits

Front-running resistance, private transactions, commit-reveal schemes

Mint/burn calculations, share price manipulation, inflation attacks

Callback validation, reentrancy guards, state consistency

Oracle price feeds, staleness checks, manipulation resistance

Liquidation thresholds, bonus calculations, cascading liquidations

Utilization curves, rate updates, compound calculations

Risk parameter validation, cap enforcement, reserve factors

Socialized losses, reserve depletion, protocol solvency

Oracle manipulation via flash loans, governance attacks

Donation attacks, inflation attacks, first depositor issues

Strategy whitelisting, harvest timing, loss limits

Withdrawal fairness, queue manipulation, front-running

Management fees, performance fees, fee timing

Operator whitelisting, stake distribution, slashing exposure

LST/underlying ratio, rebasing mechanics, oracle integration

Unbonding periods, withdrawal queues, emergency exits

Reward accrual, compounding, fee deduction

Collateral ratios, liquidation, arbitrage incentives

Collateral risk, oracle dependencies, blacklisting

Rate limits, fee structures, slippage

Bank run prevention, reserve adequacy, emergency measures

Cross-function, cross-contract, read-only reentrancy

Role management, initialization, upgrade authorization

Unchecked blocks, type casting, precision loss

Replay attacks, malleability, EIP-712 compliance

Return value checks, gas forwarding, callback safety

Proxy patterns, diamond storage, slot management

Storage layout, context preservation, untrusted targets

Commit-reveal, time-based attacks, transaction ordering

Gas limits, unbounded loops, block stuffing

Spot price usage, TWAP windows, multi-oracle

Implementation validation, storage safety, upgrade paths

Flash loan voting, proposal manipulation, timelock bypasses

Delay configuration, executor permissions, cancellation

Pause mechanisms, recovery procedures, admin keys

Return values, approve race, fee-on-transfer

Callback reentrancy, metadata handling, approval management

Nonce handling, deadline validation, signature verification