The Audit Checklist We Give Every Student
Before any Willowpoint student presents their final audit, they must demonstrate that all twenty-three items on this checklist have been addressed. We publish it here because several graduates have asked to share it with colleagues.
Access and authorization (items 1–6)
Verify that every state-changing function has appropriate access modifiers. Confirm that role assignments cannot be hijacked through indirect calls. Check that ownership transfer functions include a two-step acceptance pattern. Review whether any external call can bypass your authorization layer. Test that renounced or zero-address roles behave as expected. Document who can pause or upgrade the contract.
Reentrancy and external calls (items 7–11)
Apply checks-effects-interactions ordering consistently. Identify every external call and classify its reentrancy risk. Verify that state is finalized before value transfers. Test with a malicious callback contract on your testnet. Confirm that read-only reentrancy vectors are considered for view functions used in price calculations.
Arithmetic and logic (items 12–15)
Confirm safe math or Solidity 0.8+ overflow protection on all arithmetic. Review rounding direction in division operations — especially in payout calculations. Check for off-by-one errors in loop bounds and array indexing. Validate that enum and status transitions cannot skip states.
Oracle and external data (items 16–19)
Identify every data feed and its failure mode. Test behavior when the oracle returns stale or zero values. Verify that price manipulation through flash loans is mitigated or documented as accepted risk. Confirm timestamp dependency assumptions.
Bridge-specific (items 20–23)
Verify message replay protection across chains. Test relayer quorum under node failure. Confirm that locked funds cannot be extracted without a valid burn on the source chain. Document the recovery procedure if the bridge halts mid-transfer.
Students who miss more than three items are not permitted to schedule their final exam. They receive a written gap analysis and two weeks to remediate.