35. Auditing checklist for Vyper contracts

Even with Vyper's built-in safety nets, a careful review still matters. Check: access control on every state-changing external function, checks-effects-interactions ordering around external calls, correct use of `@nonreentrant`, bounded loop lengths, and that `DynArray`/array capacities can't be exceeded by an attacker-controlled input.

@external
@nonreentrant("lock")
def withdraw():
    amount: uint256 = self.balances[msg.sender]
    self.balances[msg.sender] = 0      # effect before interaction
    send(msg.sender, amount)           # interaction last

Also verify constructor arguments are validated (no zero addresses where a real one is required), and that immutables are set before any code path could read them uninitialised.

Check your understanding