35. Auditing checklist for Vyper contracts

Even with Vyper's built-in safety nets, a careful review still matters. Check: access control on every state-changing external function, checks-effects-interactions ordering around external calls, correct use of `@nonreentrant`, bounded loop lengths, and that `DynArray`/array capacities can't be exceeded by an attacker-controlled input.

@external
@nonreentrant("lock")
def withdraw():
    amount: uint256 = self.balances[msg.sender]
    self.balances[msg.sender] = 0      # effect before interaction
    send(msg.sender, amount)           # interaction last

Also verify constructor arguments are validated (no zero addresses where a real one is required), and that immutables are set before any code path could read them uninitialised.

Read in another language

How to study this topic

Scoring

Check your understanding

Badges