--- id: 901035 card_url: "https://mdrss.com/security/application-security-and-threat-modeling/901035" permalink_url: "https://mdrss.com/m/901035" thread_url: "https://mdrss.com/s/security" markdown_url: "https://mdrss.com/security/application-security-and-threat-modeling/901035/901035.md" title: "Awesome Audits Checklists" annotation: "A curated reference on application security & threat modeling centered on Awesome Audits Checklists. Use it as a repeatable review, validation or hardening pass." state: published thread: security domain: security category: application-security-and-threat-modeling type: guide tags: ["security-privacy-compliance", "application-security-and-threat-modeling", "checklists", "security", "awesome", "audits", "protocols", "application", "collider-club"] ontology_terms: ["concept:application-security-and-threat-modeling", "org:collider-club"] relation_terms: [] license: "MIT" version: 1 snapshot_at: "2026-08-04T16:17:00.000Z" source_url: "https://github.com/TradMod/awesome-audits-checklists" source_kind: "collider-club-curated" platform_scam_risk: 5 platform_evidence_score: 100 evidence_urls: - "https://github.com/TradMod/awesome-audits-checklists" - "https://raw.githubusercontent.com/TradMod/awesome-audits-checklists/ed7b7509f274a7a489bbe79e825b165729bbdecd/README.md" - "https://collider.club" - "https://opensource.org/licenses/MIT" --- # Awesome Audits Checklists > A curated reference on application security & threat modeling centered on Awesome Audits Checklists. Use it as a repeatable review, validation or hardening pass. > Editorial note: curated source snapshot published by [Collider.club](https://collider.club) under the MIT License. Source attribution is preserved in the front matter. ## Source snapshot # Awesome Audits Checklists > NOTE: All the resources in this repo are for educational purposes only and have been curated especially for developers and auditors. Developers should use them to build more secure applications. Auditors should benefit from these resources as well, using them to learn and secure systems but they should not [rely](https://x.com/TheTradMod/status/1941314119090446734) solely on checklists. Auditors should always adapt checklists to their specific context and prioritize a deep understanding of systems and security principles over rigid reliance on lists. This repository is a community effort, a collection of humble contributions from security researchers around the world. Thanks and respect to everyone who shares their knowledge to help make blockchain applications safer for all. ### Table of Contents - [General Smart Contract Security & Audit Checklists](#1-general-smart-contracts-security--audit-checklists) - [ERC Standards & Edge Cases](#2-erc-standards--edge-cases) - [Bridges, Interoperability & Multichain](#3-bridges-interoperability--multichain) - [DeFi Protocols](#4-defi-protocols) - [Protocols Integration Security](#5-protocols-integration-security) - [Proxies & Upgradability](#6-proxies--upgradability) - [Signature Attacks](#7-signature-attacks) - [Governance](#8-governance) - [Chains Specific Security](#9-chains-specific-security) - [Wallets Security](#10-wallets-security) - [Other/Uncategorized](#11-otheruncategorized) - [Support](#support) - [Contribution](#contribution) ## 1. **General Smart Contracts Security & Audit Checklists** - [Ultimate Security Checklist](https://www.beirao.xyz/blog/Security-checklist) — by Beirao A comprehensive checklist covering all essential aspects of smart contract security. - [Solodit Checklist](https://solodit.cyfrin.io/checklist) — by Cyfrin An actionable checklist for auditing and reviewing Solidity smart contracts. - [General Audit Checklist](https://github.com/tamjid0x01/SmartContracts-audit-checklist) — by Tamjid A general-purpose checklist for smart contract audits, covering common vulnerabilities. - [SCSVS - Smart Contract Security Verification Standard](https://github.com/ComposableSecurity/SCSVS) — by Composable Security A standardized framework for verifying the security of smart contracts. - [Smart Contract Security](https://www.rareskills.io/post/smart-contract-security) — by Rareskills An in-depth article on smart contract security concepts and best practices. - [Auditors Checklist](https://github.com/Cyfrin/audit-checklist?tab=readme-ov-file#acknowledgements) — by Cyfrin Curated list of audit checklists of different auditors. - [Pre-Audit Preparation](https://composable-security.com/blog/smart-contract-audit-the-best-tips-on-how-to-be-prepared-better/) — by Composable Security Tips and steps to prepare your project for a successful smart contract audit. - [Development Security Toolkit](https://github.com/nascentxyz/simple-security-toolkit?tab=readme-ov-file) — by Nascent A toolkit of scripts, resources and checklists for enhancing security during smart contract development. - [Multisig Security Best Practices](https://www.youtube.com/watch?v=lHk_RDzvKCc) — by Mudit Gupta Video guide covering security best practices for implementing and managing multi-signature wallets and governance systems. - [Bug Report Submission Checklist](https://immunefisupport.zendesk.com/hc/en-us/articles/15427337783057-Bug-Report-Submission-Checklist) — by Immunefi Guidelines for submitting effective and complete bug reports. - [Anti-Hack Checklist](https://github.com/Quillhash/DeFi-anti-hack-checklist) — by QuillAudits A checklist focused on preventing hacks in DeFi protocols. - [Crisis Handbook - Smart Contract Hack](https://docs.google.com/document/d/1DaAiuGFkMEMMiIuvqhePL5aDFGHJ9Ya6D04rdaldqC0/edit?tab=t.0) - SEAL A Checklist to follow when protocols get hacked and handle smart contracts hack crisis. - [Practical Security Measures for Web3 Founders](https://www.youtube.com/watch?v=Wa--zO509bA) - Mehdi SigmaPrime This is a must watch and practical measures to take for every Web3 founders, developers & researchers. ## 2. **ERC Standards & Edge Cases** ### ERC20 - [Weird ERC20 Implementations](https://github.com/d-xo/weird-erc20) — by d-xo A list of unusual or non-standard ERC20 token implementations. ### ERC721 - [Weird ERC721 Implementations](https://github.com/abarbatei/weird-erc721) — by ABA Examples of non-standard and quirky ERC721 contracts. - [ERC721 Security Thread](https://x.com/Olympix_ai/status/1757018050291761295) — by Olympix A Twitter thread discussing ERC721-specific security issues. ### ERC4626 - [ERC4626 Security Checklist](https://github.com/Solthodox/erc4626-checklist) — by Solthodox A checklist for auditing ERC4626 (tokenized vault) contracts. - [ERC4626 Rounding Issues](https://x.com/sammyaudits/status/1831615410573136327) — by Sammy A Twitter thread highlighting rounding errors in ERC4626 implementations. - [ERC4626 Vault Security Primer](https://github.com/devdacian/ai-auditor-primers/blob/main/primers/amy.vault.erc4626.primer.md) — by DevDacian Biggest ERC4626 checklist. More than 350 direct vulnerabilities, many pitfalls, integration errors and more. ### ERC4337 & Account Abstraction - [ERC4337 Security Checklist](https://github.com/aviggiano/security/blob/main/audit-checklists/ERC-4337.md) — by Aviggiano Security checklist for ERC4337 (account abstraction) contracts. ## 3. **Core Blockchain, Node & Infra** - [Core Node Security Guide](https://blog.sigmaprime.io/core-node-security.html) — by Sigma Prime A comprehensive security engineer's guide to reviewing core blockchain nodes, covering systematic approaches to conducting thorough security reviews of blockchain node implementations like Reth. - [Blockchain Security Thread](https://x.com/Designer_Misbah/status/1953906761871626751) — by Misbah Twitter thread covering general blockchain security considerations and best practices. ## 3. **Bridges, Interoperability & Multichain** - [Interoperability Protocol Security Checklist](https://github.com/windhustler/Interoperability-Protocol-Security-Checklist) — by Windhustler A checklist for securing interoperability protocols LyerZero, CCIP, Wormhole etc and cross-chain solutions. - [Multichain Auditor](https://github.com/0xJuancito/multichain-auditor) — by 0xJuancito A repository with resources and tools for auditing multichain protocols. - [Cross-chain Bridge Security Checklist](https://github.com/spearbit/portfolio/blob/master/content/bridges/BridgeSecurityChecklist.md) — by Spearbit Checklist for auditing the security of cross-chain bridges. - [Blockchain Bridge Vulnerabilities](https://github.com/the-caliber/Blockchain-bridge-vulnerabilities) — by the-caliber Repository documenting various blockchain bridge vulnerabilities and security considerations for cross-chain bridge implementations. - [LayerZero Security Research](https://lab.guardianaudits.com/encyclopedia-of-security-research/layerzero) — by Guardian Audits Encyclopedia entry covering LayerZero protocol security research, vulnerabilities, and integration considerations. ## 4. **DeFi Protocols** - [AMM Audit Checklist](https://github.com/Decurity/audit-checklists/blob/master/amm.md) — by Decurity A checklist for auditing AMM smart contracts. - [AMM Security & Audit Insights](https://mirror.xyz/millietez.eth/ixD3xe-Q7JQowYcIFmGKxkPae_C5tCN9kWn9jXUhnKk) — by Millie Tez An in-depth article on security considerations and audit tips for Automated Market Maker protocols. - [CDP Audit Checklist](https://github.com/Decurity/audit-checklists/blob/master/cdp.md) — by Decurity Checklist for auditing Collateralized Debt Positions. - [Vulnerabilities in Liquity forks Part 1](https://x.com/VulsightSec/status/1968039102848110619) - by VulSight / ZeroCipher Common Vulnerabilities in Liquity v2 forks & Considerations to safely deploy Liquity V2. - [LSD Audit Checklist](https://github.com/Decurity/audit-checklists/blob/master/lsd.md) — by Decurity Checklist for auditing LSD protocols. - [Guidelines for Auditing Staking Protocols](https://defihacklabs.substack.com/p/solidity-security-lesson-3-guidelines) - QuillAudits - Useful reference for auditing staking protocols and can help you identify potential bugs. - [LSDs Best Practices](https://mixbytes.io/blog/liquid#rec621210033) — by MixBytes Security analysis and best practices for liquid staking derivatives. - [Liquid Restaking Tokens](https://blog.sigmaprime.io/liquid-restaking.html) — by Sigma Prime An article on security considerations for liquid restaking tokens (LRTs). - [Liquidation Vulnerabilities](https://dacian.me/defi-liquidation-vulnerabilities) — by Dacian Analysis of vulnerabilities in DeFi liquidation mechanisms. - [CLM Vulnerabilities](https://dacian.me/concentrated-liquidity-manager-vulnerabilities) — by Dacian Security issues and risks in concentrated liquidity managers. - [Slippage Attacks](https://dacian.me/defi-slippage-attacks) — by Dacian Explanation of slippage attacks in DeFi and how to prevent them. - [Precision Loss Errors](https://dacian.me/precision-loss-errors) — by Dacian Discussion of errors caused by precision loss in smart contracts. ## 5. **Protocols Integration Security** - [External Integrations: The Hidden Risk in Smart Contracts](https://x.com/0xCharlesWang/status/1931486275707830730) - by CharlesWang - General External Integration Best practices and security risks. - [Across V3 Security Checklist](https://github.com/windhustler/Interoperability-Protocol-Security-Checklist/blob/main/audit-checklists/Across.md) — by TradMod (ABDul Rehman) A detailed checklist for auditing the security of Across V3 cross-chain messaging protocol integrations. - [LayerZero V2 Security Checklist](https://github.com/windhustler/Interoperability-Protocol-Security-Checklist/blob/main/audit-checklists/LayerZeroV2.md) — by windhustler A detailed checklist for auditing the security of LayerZero V2 cross-chain messaging protocol integrations. - [Wormhole Security Checklist](https://github.com/windhustler/Interoperability-Protocol-Security-Checklist/blob/main/audit-checklists/Wormhole.md) — by windhustler A comprehensive audit checklist for Wormhole bridge integrations, highlighting key risks and best practices. - [Chainlink CCIP Security Checklist](https://github.com/windhustler/Interoperability-Protocol-Security-Checklist/blob/main/audit-checklists/Chainlink-CCIP.md) — by windhustler A thorough checklist for reviewing and securing Chainlink CCIP (Cross-Chain Interoperability Protocol) implementations. - [Berachain Oracle Bugs](https://x.com/blckhv/status/1928502350999687388?t=sNBNAMdhhSp9TkSGLlvpzg&s=19) — by blckhv Twitter thread detailing bugs found in Berachain's oracle implementation. - [Stargate v2 Integration Checklist](https://mirror.xyz/0xaeDAA951e7fbe1031E3553a7a8b1d8A89b132d7b/WfZ1ewSlkbErd-swiBV0AGbQ0xEWdnq6nCzDNStDUKI) — by EngimaDark/Windhustler Secruity Checklist for for Stargate V2 contracts integrations. ### UniswapV4 Hooks Integration Guides - [Questions To Ask Before Writing a Uniswap v4 Hook](https://blog.openzeppelin.com/6-questions-to-ask-before-writing-a-uniswap-v4-hook) - by OpenZeppelin This guide outlines some key considerations when designing a UniswapV4 hook to suit your specific needs. - [Uniswap V4 Hooks Security Talk](https://www.youtube.com/watch?v=Fbxsv8rxHZw) — by Damian (Composable Security) A detailed presentation on Uniswap V4's architecture and the main security threats and best practices when building custom hooks. - [Uniswap V4 Hooks Security Deep Dive](https://www.youtube.com/watch?v=4o8yGcq6tfM) — by Jota Carpanelli (OpenZeppelin) A technical walkthrough of Uniswap V4 hooks, including how to build, test, and secure custom hooks. - [Auditing Uniswap V4 Hooks](https://hacken.io/discover/auditing-uniswap-v4-hooks/) — by Hacken An article outlining the main audit considerations, attack vectors, and recommendations for Uniswap V4 hook integrations. - [Uniswap V4 Hooks Security Considerations](https://www.quillaudits.com/blog/web3-security/uniswap-v4-security-considerations) — by QuillAudits A breakdown of the new security challenges and mitigation strategies for Uniswap V4 and its hooks. - [Uniswap V4 Hooks Integration Security Considerations](https://www.certik.com/resources/blog/uniswap-v4-hooks-security-considerations) — by CertiK A blog post analyzing the unique security risks introduced by hooks in Uniswap V4 and how to address them. - [Uniswap V3/V4 Security](https://lab.guardianaudits.com/encyclopedia-of-security-research/uniswap) — by Guardian Audits Comprehensive security research and analysis of Uniswap V3 and V4 protocols, covering integration risks and security considerations. ## 6. **Proxies & Upgradability** - [Upgradable Patterns](https://www.youtube.com/watch?v=Zjj5lDmHlq8) — by Daniel Von Fange Video explaining common patterns for upgradable smart contracts. - [Upgradable Contracts Twitter Thread](https://x.com/pashovkrum/status/1699407698750578765) — by Pashov Krum Twitter thread discussing upgradability and proxy contract security. - [UUPS Proxy Security](https://www.rareskills.io/post/uups-proxy) — by Rareskills Article analyzing the security of UUPS proxy pattern in Solidity. ## 7. **Signature Attacks** - [Signature Replay Attacks](https://dacian.me/signature-replay-attacks#cmb200fic000009jrbs2y2cnw) — by Dacian In-depth explanation of signature replay attacks in smart contracts. - [Signatures](https://medium.com/coinmonks/ethereum-signatures-for-hackers-and-auditors-101-4da766cd6344) — by Coinmonks (Medium) A beginner-friendly guide to Ethereum signatures and their security implications. - [Signature Replays](https://dacian.me/signature-replay-attacks) — by Dacian General overview of replay attack vectors and prevention. ## 8. **Governance** - [DAO Governance Attacks](https://dacian.me/dao-governance-defi-attacks) — by Dacian Analysis of attacks and vulnerabilities in DAO governance mechanisms. - [DAO Governance Security](https://blog.sigmaprime.io/governance-dao.html) — by Sigma Prime Common vulnerabilities in protocol governance and DAOs, covering reentrancy, insider threats, flash loan voting, proposal execution issues, and other governance-specific attack vectors. ## 9. **Chains Specific Security** - [Multichain Auditor](https://github.com/0xJuancito/multichain-auditor) — by 0xJuancito A repository with resources and tools for auditing multichain protocols. ### Solana - [Solana Program Security Guide](https://www.helius.dev/blog/a-hitchhikers-guide-to-solana-program-security) — by Helius A comprehensive hitchhiker's guide to Solana program security covering common vulnerabilities, attack vectors, and mitigation strategies for intermediate/advanced developers building on Solana. - [Solana Best Practices](https://github.com/slowmist/solana-smart-contract-security-best-practices) — by Slowmist Best practices for securing Solana smart contracts. - [SPL Token-2022](https://neodyme.io/en/blog/token-2022/#tldr) - by Neodyme Potential security pitfalls and best practices for secure implementation of the new Solana SPL token extensions. - [Solana Not-So-Smart Contracts](https://secure-contracts.com/not-so-smart-contracts/solana/index.html) — by ToB Secure Contracts Examples of security issues in Solana contracts. - [Solana Advanced Security](https://substack.com/home/post/p-164534668) — by Nirlin Advanced security topics for Solana developers. ### Arbitrum - [Arbitrum Integration Bugs](https://github.com/windhustler/Interoperability-Protocol-Security-Checklist/blob/main/audit-checklists/Arbitrum.md) — by Windhustler Arbitrum Security pitfalls and integration guide. ### Algorand - [Algorand Not-So-Smart Contracts](https://secure-contracts.com/not-so-smart-contracts/algorand/index.html) — by ToB Secure Contracts Security pitfalls and real-world issues in Algorand contracts. ### Starknet (Cairo) - [Starknet Not-So-Smart Contracts](https://secure-contracts.com/not-so-smart-contracts/cairo/index.html) — by ToB Secure Contracts Examples of vulnerabilities in Starknet (Cairo) contracts. ### Cosmos - [Cosmos Not-So-Smart Contracts](https://secure-contracts.com/not-so-smart-contracts/cosmos/index.html) — by ToB Secure Contracts Security issues and case studies in Cosmos contracts. ### Substrate - [Substrate Not-So-Smart Contracts](https://secure-contracts.com/not-so-smart-contracts/substrate/index.html) — by ToB Secure Contracts Security analysis of Substrate-based smart contracts. ### Ton - [Ton Not-So-Smart Contracts](https://secure-contracts.com/not-so-smart-contracts/ton/index.html) — by ToB Secure Contracts Security vulnerabilities in TON smart contracts. - [Ton Security Checklists](https://github.com/PositiveSecurity/ton-audit-guide) — by PositiveSecurity Checklist for Auditing TON Smart Contracts ### Tron - [Checklist for Auditing Tron Projects](https://github.com/PositiveSecurity/tron-audit-guide) — by PositiveSecurity A guide to common bugs and integration pitfalls in Tron Contracts. ### Blast - [Blast Integration Guide](https://nirlin-blast-bugs.notion.site/Blast-Integration-Bugs-Guide-131344ccd05642bdbb49d2026c3227cf) — by Nirlin A guide to common bugs and integration pitfalls in Blast. ### Near - [Near Smart Contracts Checklist](https://docs.near.org/smart-contracts/security/checklist) — Near Docs Near smart contracts security considerations list ### Binance Chain - [BNB Chain Security Tips](https://cantina.xyz/blog/bnb-chain-security-tips) — by Cantina Top 15 security recommendations for BNB Chain developers covering vulnerability patterns, exploit defenses, and secure engineering practices specific to BNB Chain development. ### Hyperliquid - [Pitfalls of LST on Hyperliquid](https://medium.com/@talfao_94085/implementation-and-security-pitfalls-of-lst-on-hyperliquid-b83b8fd42713) — by Talfao Implementation and Security Pitfalls of LST on Hyperliquid. ## 10. **Wallets Security** - [Web3 Wallet Security Checklist](https://blockapex.io/web3-wallet-security-checklist/) — by BlockApex A practical checklist covering best practices for securing Web3 wallets. - [All Wallet Security Checklist](https://www.slowmist.com/service-wallet-security-audit.html) — by SlowMist A comprehensive checklist for auditing and securing various types of crypto wallets. - [Account Abstraction](https://mixbytes.io/blog/account-abstraction#rec613585484) — by MixBytes An article exploring security considerations for account abstraction. - [Account Abstraction Audit Checklist](https://slowmist.medium.com/slowmist-security-audit-checklist-for-account-abstraction-wallets-ed48fc10cdbc) — by Slowmist Audit checklist for account abstraction wallets. - [Crypto Wallet Security Assessment Checklist ](https://www.certik.com/resources/blog/cryptowalletsecurityassessmentchecklist) — by Certik A checklist outlining key steps and best practices for assessing the security of crypto wallets. - [Web3 Wallet Security Checklist](https://blockapex.io/web3-wallet-security-checklist/) — by BlockApex A practical checklist covering best practices for securing Web3 wallets and wallet security assessment methodologies. ## 11. **Other/Uncategorized** - [Oracle Security Thread](https://x.com/0xjmaria/status/1939980905453367761) — by @0xjmaria Twitter thread detailing oracle-specific security considerations and vulnerabilities. - [Oracles and Pricing Security](https://blog.sigmaprime.io/oracles-and-pricing.html) — by Sigma Prime Comprehensive guide to common vulnerabilities in oracles and pricing feeds, covering spot pricing attacks, homegrown oracle issues, time delays, gas congestion, and price manipulation techniques. - [Solidity Gas Optimizations](https://github.com/TechnoGeek01/solidity-gas-optimizations) — by TechnoGeek01 A curated list of gas-saving techniques and best practices for Solidity smart contract development. - [2020 Smart Contract Security Paper](https://arxiv.org/pdf/2008.04761) — by Nicola arXiv Academic paper reviewing the state of smart contract security as of 2020. - [Chainlink Oracle Attacks](https://medium.com/cyfrin/chainlink-oracle-defi-attacks-93b6cb6541bf) — by Cyfrin Article on past attacks and vulnerabilities involving Chainlink oracles. - [Chainlink VRF Security](https://docs.chain.link/vrf/v2/security) — by Chainlink Official documentation on the security model of Chainlink's Verifiable Random Function. - [SWC Registry](https://swcregistry.io) — by SWC Registry A comprehensive database of known smart contract vulnerabilities, each with a unique identifier and detailed description. - [Solidity Inline Assembly Vulnerabilities](https://dacian.me/solidity-inline-assembly-vulnerabilities) — by Dacian Security risks and pitfalls when using inline assembly in Solidity. - [Solidity DevSecOps Standard](https://github.com/0xsomnus/Solidity-DevSecOps-Standard) — by 0xsomnus DevSecOps best practices and standards for Solidity development. - [How To Multisig](https://howtomultisig.com/) - SEAL/fredrik Best practices on how to implement secure standard operation procedures for multisigs. - [CREATE/CREATE2 Security Pitfalls](https://mixbytes.io/blog/pitfalls-of-using-cteate-cteate2-and-extcodesize-opcodes) — by MixBytes Analysis of security pitfalls when using CREATE, CREATE2, and EXTCODESIZE opcodes in smart contract development. - [EIP-7702 Security Considerations](https://www.youtube.com/watch?v=ZFN2bYt9gNE) — by Tincho/Red Guild Video discussion on security implications and considerations for EIP-7702 implementation. ## Support If you want to support this repo and its contributors, you can do it on the [Terminal](https://terminal.merit.systems/TradMod/awesome-audits-checklists). Thanks! ## Contribution If you'd like to contribute reach out on [X](https://x.com/TheTradMod), or Simply create a PR anon :) --- ## About Collider.club This card belongs to the curated knowledge base of **[Collider.club](https://collider.club)** — a closed business club for entrepreneurs, engineers, investors and domain experts building projects for international markets. Members work across DeFi, AI/ML, FinTech, Web3, banking, hardware and venture capital, and the club runs closed sessions on high-margin niches with anonymous speakers. - Club: - Collection: Collider.club curated card library (`mdrss-card/v2`) - Maintainer: Collider.club editorial team ## License MIT License — Copyright (c) 2026 Collider.club. Full text: [LICENSE](../../LICENSE) ·