Skip to main content
BelizeChain Docs
GitHub

Security Checklist

Run through this checklist before deploying any ink! contract to a live network. Items marked with code are mechanical checks; the rest require reading the contract.

Pre-Audit Preparation

  • cargo contract build completes without warnings
  • cargo test --all passes
  • cargo fmt --check passes
  • cargo clippy --all-targets -- -D warnings passes
  • No secrets, keys, or credentials in the repository history

Access Control

  • Owner is set explicitly in the constructor
  • Every admin function validates the caller (ensure_owner / ensure_role)
  • Ownership transfer validates the new owner and rejects the zero address
  • OwnershipTransferred events are emitted
  • Roles are defined as constants; each role has a defined admin
  • Role holders can renounce their own roles only

Arithmetic Safety

  • No plain +, -, * on user-influenced values — use saturating_* or checked_*
  • Divisions handle a zero divisor (checked_div(...).ok_or(...))
  • No unchecked casts that can truncate balances

Token Standards (PSP22 / PSP34 / PSP37)

  • All required functions of the standard are implemented
  • Transfers to the zero address are rejected
  • approve / transfer_from / allowance flows behave correctly
  • Transfer and Approval events fire on all state changes
  • Total supply accounting is atomic with mint/burn

State and Calls

  • Cross-contract calls cannot re-enter unguarded state
  • Critical functions respect pause state where applicable
  • Storage growth is bounded — large payloads go to Pakit with content IDs referenced on-chain

Events and Observability

  • Every state transition emits an event
  • Events carry enough context to reconstruct state transitions off-chain

Deployment

  • ABI and metadata regenerated from the audited commit
  • Constructor arguments double-checked (owner, initial supply)
  • Contract deployed to testnet and exercised end-to-end before mainnet
  • Deployed code hash recorded for verification

Related