Web3Sec Community Checklist
Smart Contract Checks
Reentrant Calls
Fee on Transfer
Balance Modifications Outside of Transfers (rebasing/airdrops)
Upgradable Tokens
Flash Mintable Tokens
Tokens with Blocklists
Pausable Tokens
Approval Race Protections
Revert on Approval To Zero Address
Revert on Zero Value Transfers
Multiple Token Addresses
Low Decimals
High Decimals
transferFrom with src == msg.sender
Non-string metadata
Revert on Transfer to the Zero Address
No Revert on Failure
Revert on Large Approvals & Transfers
Code Injection Via Token Name
Unusual Permit Function
Using very small amounts as inputs (e.g., 1 wei)
Passing zero as an input
Using contracts that cannot accept ether
Gas griefing with external calls
Weird ERC20 tokens (fees, 777, return values, etc...)
Price manipulation
Blacklisted ERC20 addresses
Potential overflow/underflow
Block re-orgs
Reentrancy (721, inter-function, inter-contract, inter-system (read-only))
Sybil attacks on incentives/tokenomics
Flash loans (even flash mints e.g. Dai)
Accepting any data from an arbitrary address (Malicious bytes)
Inflating internal accounting by sending tokens to the system
Forced precision loss when precision really matters (min balance checks etc...)
Addresses that might be empty at one point, yet house contract code at another
Reverting (external calls I can make revert, inputs I can use to cause a revert)
Unexpected addresses (provide a 'receiver' address pointing to another contract in the system)
Selector clashing
Signatures (replay, malleability, recover to 0 address etc...)
Hash collision (encodePacked)
Checking external calls
Function visibility
Overflow and underflow preventions
Time manipulation within a few minutes only
Utilizing reliable and audited dependencies
Fix warnings to avoid tricky features
Validate external or public functions
Checking rounding errors and unexpected behaviors
Unbounded loops preventions
Lowering down pseudo-randomness
Using the latest solidity versions performing change verification
Push payments and their correct usage
Old solidity constructs and their frequent updates
