How to prepare for a smart contract audit

A Hackerbane smart contract report names the revision it read. The ForeverMoney bridge report is tied to one commit. Its scope section names the repository, that commit, the files that were read, and what was left out. The overview says what the system does and which roles can move funds or change the rules. Where tests were run, that report records the command and the toolchain on a clean worktree of the review commit. Have this packet ready before kickoff.

Freeze the commit

Choose the revision you want reviewed and record the full commit hash. The ForeverMoney report pins the review commit. A later fix is recorded as its own commit in the remediation record. Put the hash in the brief, and stop merging into that revision until the review is underway.

Get the tests passing

Check out that commit in a clean directory and run the test command you expect the reviewer to run. If the suite fails, fix it, or list the failures you already accept. That report records forge test on a clean worktree of the review commit. If your suite is not Foundry, name the command you use.

Write the architecture down

Say what each contract is for, how assets move, and which external systems it calls. That is the description the overview has to open with. If it is missing, the reviewer reconstructs the system from the code, and that reconstruction may differ from the system you meant to ship.

Write the privileges down

List every privileged role that can mint, pause, upgrade, set a fee, withdraw, or change a parameter. For each one, say what it can do and which address, key, or contract holds it. Say when one address holds more than one role. The overview has to state who can move funds or change the rules.

Name what is in scope and what is out

List the files and contracts to review. Then list what is out of scope: dependencies, the frontend, other products, and any commit after the pin. The ForeverMoney scope section is written as that list. Mark anything you do not want read as out of scope before kickoff, including work that is still moving.

Leave a way to build the code

Write the commands a stranger can run on a clean checkout of the pinned commit: how to install the toolchain, how to compile, and how to run the tests. Name the versions. If the build needs a private network, a fork URL, or a secret, say what the reviewer can do without it. The ForeverMoney report records the command that actually ran. If that command is missing, the review starts by making the tree build.