Before an independent audit, freeze the code, write down what the contract is meant to do, and have tests and an access control map ready. ethereum.org notes that audits add a review round that can catch what developers missed, but they are not a cure-all. Preparation decides how much of that round is spent on real problems.
Freeze and document
- Tag a commit and stop changing it. Reviewing a moving target wastes the review.
- Add NatSpec comments and inline notes. ethereum.org advises documenting code well to get the most from an audit.
- Write a short specification: the invariants, the actors, what each is allowed to do, and what must never happen.
Show your own testing
Hand over unit and negative tests, fuzz properties and static analysis output. See the testing ladder. If your own tools find nothing, auditors can look deeper. If they find a lot, fix those first.
Map access control
List every privileged function, who can call it, and what holds that key. Say whether admin sits behind a multisig and a delay. The ethereum.org guidance describes a single owner key as a single point of failure, so reviewers will ask. See Ownable or AccessControl.
Describe the external world
- Which oracles or feeds does the contract read, and what happens if one is stale?
- Which other contracts does it call, and which are upgradeable?
- What assumptions do you make about ordering and timing?
Plan the response
Decide before launch how you will react to a finding or an incident. ethereum.org mentions circuit breakers, event monitoring and bug bounties scaled to funds at risk so that reporting is more attractive than exploiting. Have a pause path and an owner for each alert, as in circuit breaker design.
After the report
- Triage every finding with a severity and an owner.
- Fix, then ask for confirmation of the fixes, not just your own retest.
- Record accepted risks with a reason and a date.
- Make sure the deployed code is the audited commit, using source verification.
Try it yourself
Open the pull request gate demo and see how a rule can block a merge until required checks pass. Look at how the gate reports why it failed.
Click through it at your own pace, or open it full screen.
Safeguard's policies and gates can hold a merge until those checks pass, and its free scan at gold.safeguard.sh/scan covers dependencies in the same repository.
Quick check
Does an audit guarantee the contract is safe?
No. It is one more review round. The security guidance says to combine it with testing, monitoring and a response plan.
Why freeze the code?
Findings apply to a specific version. If the code changes afterward, the report no longer describes what you deploy.
Sources
Last reviewed: 19 October 2026.
