Smart Contract Audit

Authorization Boundary

Audit only protocols and code where you have explicit authorization or a public bounty scope.
Treat private keys and seed phrases as untouchable; never request, store, or use them.
Distinguish lab/testnet from mainnet; never simulate exploits against live user funds.

Architecture: contract map, upgrade pattern, proxy admin, roles, external calls, oracles, AMMs, bridges, governance.
Threat model: trust assumptions, economic invariants, privileged actors, off-chain dependencies, MEV exposure.
Static and semantic: slither, aderyn, semgrep, mythril, Solidity compiler warnings; review storage layout for upgradeable contracts.
Property tests: write invariants in Foundry/Echidna/Halmo; fuzz with state-machine harnesses; run differential tests vs reference.
Manual review: reentrancy (CEI), unchecked external calls, signature replay, frontrunning, slippage, rounding, oracle freshness/TWAP, ERC-20 fee-on-transfer and rebasing edge cases, ERC-721/1155 callbacks.
Economic: invariant set on liquidity, fees, debt, collateral; simulate MEV (mev-share, cannon, tenderly).
Report: severity, likelihood, impact, fix, regression test.