Practical overview
When it fits
Use it when planning or conducting a manual review and as a prompt list to adapt to the contract under examination.
Who it is for
- Auditors and developers preparing a Solidity contract review.
- Teams creating a starting checklist for audit scoping or internal review.
Documented uses
- Structure a manual Solidity review around common security and implementation questions.
- Get an initial picture of a codebase using metrics and file-counting suggestions before an audit.
- Check whether contract-specific behaviors, such as crowdsale refunds or vesting, need review.
Requirements & limits
The checklist is publicly available in a GitHub repository that declares an MIT license.
- The repository explicitly says the list is not comprehensive and Solidity changes quickly.
- Items are not universally applicable; select and adapt checks to the contract and audit scope.
- The suggested metrics and shell-based examples help characterize code, but are not security verification.
Check current requirements in the official documentation. Source-based guidance does not mean OpenViST has run or independently tested this project.
Scope a Solidity audit using repository metrics
Gather basic information about a Solidity project’s codebase before beginning an audit.
Before you start
- A checked-out project codebase.
- The README names Solidity-Code-Metrics as an aid for understanding project scope and shows installing it with npm.
- The README also describes cloc as a helper for measuring source lines of code.
Steps
Review the project codebase before starting the audit.
Use Solidity-Code-Metrics to help understand the project’s scope; the README lists the command below as its installation command.
npm install solidity-code-metricsUse cloc to measure source lines of code, following its installation guidance linked from the README.
Use the README’s example approaches to count Solidity files, inspect per-file line counts, and calculate SHA256 hashes of Solidity files.
Expected outcome
A preliminary view of codebase scope, including example metrics such as source-file counts, line counts, and file hashes.
Guide limitations
- The checklist says it is not comprehensive and Solidity evolves quickly; perform additional due diligence.
- Not every checklist item applies to every contract.
- The README presents these tools as scoping helpers, not as a complete audit or a substitute for reviewing the contract.
Review Solidity contracts with the general checklist
Use the repository’s general review questions to structure a manual Solidity contract review.
Before you start
- A Solidity contract or project to review.
- The repository checklist; it advises tailoring items to the specific contract.
Steps
Review function visibility, arithmetic operations, address handling, input conditions, state changes, and reentrancy protections against the checklist.
Check applicable interface, type, gas, and constructor-initialization considerations.
Review testing considerations, including method and input coverage, fuzz testing, and possible contract states.
For a crowdsale, assess only applicable checklist items such as timing, contribution limits, refunds, vesting, and owner-controlled functions.
Expected outcome
A structured set of review considerations to guide manual examination of the contract and applicable crowdsale logic.
Guide limitations
- The checklist explicitly states that it is not comprehensive and may not apply in full to a particular contract.
- The repository cautions that Solidity evolves quickly and calls for additional due diligence.
- The checklist is a reference, not an executable auditing or verification tool.
Sources & review
Source record details
- Source availability
- Active
- Sources checked
- 14 October 2026
- Original website title
- tamjid0x01/SmartContracts-audit-checklist · Official homepage title · retained in its source language