Web3 Security Checklist for Startups in the Bay Area
Launching a DeFi protocol or blockchain gaming project in San Francisco? Security cannot be an afterthought. This checklist covers the critical security steps Bay Area Web3 startups should complete before going live on mainnet.
Important: Items marked as critical should be treated as blockers before mainnet deployment. Non-critical items are strongly recommended but may be addressed post-launch with appropriate mitigations.
Smart Contract Development Security
Build on OpenZeppelin's battle-tested contracts rather than writing custom implementations of common patterns (ERC20, ERC721, access control, etc.).
Use Solidity 0.8.0+ for automatic integer overflow/underflow protection. If you must use unchecked blocks, document and justify each usage.
Always complete all state changes before making external calls. Apply ReentrancyGuard to any function that makes external calls.
Design your role hierarchy before writing code. Use OpenZeppelin's AccessControl for multi-role systems. Never leave admin functions unprotected.
Avoid spot price oracles. Use TWAP, Chainlink, or multi-oracle aggregation. Add circuit breakers for extreme price deviations.
Target 95%+ line coverage for core contract logic. Test all edge cases, boundary conditions, and failure scenarios.
Pre-Launch Security Review
Use Slither, Mythril, and Echidna to catch common vulnerabilities automatically. Integrate these into your CI/CD pipeline.
Have at least two senior developers review all contract code with a security focus. Create a review checklist based on known vulnerability patterns.
For any protocol handling real user funds, a professional audit is non-negotiable. Budget for it early and choose an auditor with verifiable experience.
Deploy to a testnet and run a bounty program on Immunefi or similar platforms. The community will find issues your internal team missed.
If your contracts are upgradeable, verify that upgrade paths work correctly. Test your pause mechanisms and ensure they can be activated quickly.
Key Management & Operational Security
Never use a single EOA as the admin of any contract with significant TVL. Use Gnosis Safe with a minimum 3-of-5 multisig for all privileged operations.
Add a timelock contract (minimum 24 hours, ideally 48-72 hours) for admin actions like parameter changes, upgrades, and fund transfers.
Use hardware wallets for deployment. Never store private keys in environment variables in CI/CD. Use dedicated key management services for production.
Use separate keys for different operational roles. Rotate keys regularly. Revoke access immediately when team members leave.
Check for wallet drainer injection points, transaction simulation spoofing, and IPFS/ENS resolution attacks on your dApp frontend.
Incident Response Planning
Implement pause functionality for all critical contract operations. Test that pause can be activated within minutes by on-call team members.
Document step-by-step procedures for common incident types: reentrancy exploits, oracle manipulation, access control breaches. Practice tabletop exercises.
Use Forta, OpenZeppelin Defender Sentinel, or custom monitoring to alert on large unusual transactions, failed pause attempts, and parameter changes.
Publish a security.txt, create a disclosure email, and respond to researchers promptly. Whitehats who find bugs should be rewarded, not threatened.
Have direct contacts at major CEXes, Chainlink, law enforcement, and blockchain forensics firms. In a live exploit, every minute counts.
Need Help Working Through This Checklist?
VLN works with Bay Area blockchain startups at every stage — from initial architecture reviews to full pre-launch audits. Our team can help you implement every item on this checklist and identify vulnerabilities your internal team may have missed.
Get Your Free 30-Minute Security Scan
We'll review your highest-risk contract and identify immediate security concerns — at no cost.