Smart Contract Security Review Checklist

Use this checklist before enabling production smart contracts on a network or before promoting a new contract runtime profile to mainnet. Every checked item needs evidence: a command output, reviewed configuration, governance proposal, audit record, or incident/runbook link.

Review these companion security documents first:

• External Security Audit Package
• Smart Contract Threat Model
• Runtime Reproducible Builds
• Contract Author Security Guide

Copy this header into the review ticket:

Network:
Runtime profile:
Protocol version:
Review date:
Review owner:
Release/build:
Governance proposal:
Final status: pending | approved | blocked

For each item, record:

Evidence:
Owner:
Status: pending | pass | fail | waived
Notes:

Waivers must include the risk, expiry date, and explicit approver. Do not use this checklist to waive deterministic replay, runtime metering, registry policy, bucket access enforcement, or restore verification.

1. WASM Runtime And Sidecar

• [ ] Production uses the Rust Wasmtime sidecar runtime, not the old in-process Node fallback.
• [ ] The active runtime profile is protocol-pinned and immutable for replay.
• [ ] The sidecar capability handshake reports the expected protocol version, executor version, Wasmtime version, ABI version, metering model, and limits.
• [ ] Runtime mismatch or unavailable sidecar fails closed before contract activation or call execution.
• [ ] Native Wasmtime fuel metering is enabled and bounded for every call.
• [ ] Memory limits, timeout limits, args limits, event limits, return limits, and host IO limits are enforced.
• [ ] Malformed modules, forbidden imports, traps, memory pressure, large args, large events, fuel exhaustion, and sidecar crash recovery have deterministic failure behavior.
• [ ] Compatibility vectors exist for every supported protocol-pinned runtime profile.

Evidence commands:

npm run test:contract-wasmtime-sidecar
npm run test:contract-wasmtime-sidecar-lifecycle
npm run test:contract-runtime-security
npm run test:contract-runtime-compatibility
npm run test:contract-deterministic-metering

2. Host Imports And ABI Surface

• [ ] The contract import allowlist contains only reviewed host imports.
• [ ] Every host import is deterministic and has bounded memory/payload behavior.
• [ ] Host import failures preserve stable failure codes for replay.
• [ ] Storage, bucket metadata reads, encrypted-record metadata writes, events, and return values are applied only after successful deterministic execution.
• [ ] ABI schemas define method inputs, outputs, events, and expected return shapes.
• [ ] ABI/schema data is available through the HTTP API for operator and console tooling.
• [ ] AssemblyScript SDK examples build against the current ABI and host surface.

Evidence commands:

npm run test:contract-wasm-host-imports
npm run test:contract-abi
npm run test:contract-return-values
npm run test:contract-fuzz
npm run contracts:as-sdk:test

3. Runtime Metering And Limits

• [ ] Protocol max fuel is consensus-defined.
• [ ] Per-method manifest maxFuel is clamped by the protocol max.
• [ ] Host fuel charging is deterministic and cannot be bypassed by nested calls.
• [ ] Out-of-fuel, payload-too-large, event-too-large, and return-too-large results are stable transaction failures.
• [ ] Metering behavior is covered by replay tests that compare resulting state roots.

Evidence commands:

npm run test:contract-deterministic-metering
npm run test:contract-execution-limits
npm run test:contract-runtime-security

4. Registry And Release Policy

• [ ] Governance/operator policy decides whether registry enforcement is required on this network.
• [ ] Approved package records include package name, version, code hash, manifest hash, descriptor hash, runtime, status, audit metadata, approval metadata, approver, transaction hash, and heights.
• [ ] Suspended or retired packages cannot be instantiated through the approved release path.
• [ ] On-chain provenance is enforced for deployed contract code and manifests.
• [ ] The release workflow covers package approval, deployment, instantiation, readiness, migration, deactivation, rollback, and failure handling.

Evidence commands:

npm run test:contract-registry
npm run test:contract-on-chain-provenance
npm run test:contract-release-workflow

5. Contract Activation Gates

• [ ] Production smart contracts are disabled until governance explicitly activates the runtime.
• [ ] Activation requires production preflight success.
• [ ] Runtime rollout policy and validator attestations are present and match the active runtime profile.
• [ ] Readiness fails closed when required buckets, permissions, payloads, or runtime capabilities are unavailable.
• [ ] Operator readiness API and CLI views are available before launch.

Evidence commands:

npm run test:contract-runtime-activation
npm run test:contract-runtime-rollout-policy
npm run test:contract-runtime-preflight
npm run test:contract-readiness
npm run test:contract-readiness-operator-surface

6. Contract-To-Contract Calls

• [ ] Maximum call depth is consensus-defined and enforced.
• [ ] Cycles fail deterministically.
• [ ] Nested rollback order is deterministic and all writes/events/returns roll back together on failure.
• [ ] Nested fuel behavior is bounded and cannot escape caller limits.
• [ ] Target contract deactivation is enforced for nested calls.
• [ ] Nested bucket ciphertext unavailability fails safely.
• [ ] Caller, callee, user, organization, and contract-principal auth rules are documented and tested.

Evidence commands:

npm run test:contract-to-contract-calls
npm run test:contract-c2c-adversarial

7. Bucket Access And Ciphertext Availability

• [ ] Contract manifests declare every bucket needed by the contract.
• [ ] Deployment/readiness rejects contracts on nodes missing required local bucket availability.
• [ ] Contract bucket access rules are enforced for metadata reads and encrypted record metadata writes.
• [ ] Ciphertext availability behavior is deterministic for local and nested contract calls.
• [ ] Encrypted-record writes preserve bucket policy, key metadata, transaction hash, and state-root materialization.
• [ ] Restored nodes recompute readiness instead of trusting backed-up local readiness rows.

Evidence commands:

npm run test:contract-host-api
npm run test:contract-readiness
npm run test:contract-backup-disaster-recovery

8. Contract State And Isolation

• [ ] Each contract has an isolated state namespace.
• [ ] A contract cannot write another contract's state except through approved contract-to-contract call semantics.
• [ ] Failed calls do not leak partial storage writes, events, encrypted-record writes, or return values.
• [ ] State-root keys and values are canonical and deterministic.

Evidence commands:

npm run test:contract-call-execution
npm run test:contract-to-contract-calls
npm run test:contract-c2c-adversarial

9. Migrations And Rollbacks

• [ ] Migration proposals identify source and target contracts.
• [ ] Source and target code hashes and manifest hashes are pinned when required.
• [ ] Raw-copy, schema-transform, and contract-defined migration policies are reviewed for this network.
• [ ] Partial/resumable migration jobs are bounded and idempotent.
• [ ] Migration batches are deterministic and replayable.
• [ ] Rollback procedure is documented in the release workflow.
• [ ] Migration rows restore from snapshots/backups.

Evidence commands:

npm run test:contract-state-migration
npm run test:contract-state-migration-jobs
npm run test:contract-defined-state-migration
npm run test:contract-release-workflow
npm run test:contract-backup-disaster-recovery

10. Events, Returns, Metrics, And Observability

• [ ] Contract events use deterministic event indexes.
• [ ] Event query APIs work by contract id, topic, method, transaction, and block range.
• [ ] Structured return values are persisted and queryable.
• [ ] Per-contract metrics track calls, failures, runtime errors, fuel used, host calls, events, and writes.
• [ ] Prometheus/JSON monitoring endpoints are stable for external alert managers.
• [ ] Production alert thresholds are reviewed and enabled.

Evidence commands:

npm run test:contract-events
npm run test:contract-event-query-api
npm run test:contract-return-values
npm run test:contract-observability
npm run test:contract-production-alerts
npm run test:contract-production-monitoring-integration

11. Replay, Snapshots, Backup, And Restore

• [ ] Replay verification passes from genesis or checkpoint bootstrap.
• [ ] Same block inputs produce the same state root.
• [ ] Runtime compatibility vectors pass for every supported pinned profile.
• [ ] Snapshot archives verify before import.
• [ ] Contract code, manifests, registry entries, state, events, migrations, and call results restore from backup.
• [ ] Readiness and metrics are understood as local operational state and are recomputed/recollected after restore.
• [ ] Backup drill has been run on the production-like rehearsal environment.

Evidence commands:

npm run test:snapshots
npm run test:contract-backup-disaster-recovery
npm run test:contract-runtime-compatibility
npm run verify:chain
npm run verify:replay
npm run noos -- production backup-drill --output ./backup-drill

12. Operator Procedures And Incident Response

• [ ] Sidecar rollout, runtime mismatch, stuck readiness, contract failure spikes, and contract deactivation runbooks are reviewed.
• [ ] Deactivation dependency tooling checks manifest calls, pending migrations, registry status, and dependent callers before deactivation.
• [ ] Production preflight includes contract runtime and activation gate checks.
• [ ] Monitoring alerts have an owner and escalation path.
• [ ] Backup/restore and contract readiness repair procedures are rehearsed.
• [ ] Operator tokens, private keys, DEKs, plaintext payloads, and local ciphertext bytes are excluded from logs/support bundles.

Evidence commands:

npm run test:contract-deactivation
npm run test:contract-deactivation-dependencies
npm run test:contract-deactivation-policy
npm run test:contract-production-rollout-rehearsal
npm run test:contract-production-multinode-rehearsal
npm run test:contract-operator-launch-rehearsal
npm run soak:contracts:smoke
npm run noos -- production preflight --profile validator
npm run noos -- production monitor-report --json

13. Final Readiness Evidence

• [ ] Machine-readable launch gate report generated:

  npm run noos -- contracts launch-gate --profile mainnet --json

• [ ] Runtime provenance report generated:

  npm run contracts:sidecar:provenance
  npm run noos -- contracts runtime provenance --json

• [ ] All required commands passed on the release/build being promoted.

• [ ] Governance activation proposal references this completed checklist.

• [ ] Runtime profile, sidecar binary, node binary, docs revision, and migration set are recorded.

• [ ] Open findings are either fixed or explicitly blocked from mainnet launch.

• [ ] Rollback and deactivation owners are named.

• [ ] Backup artifact and successful backup-drill report are attached.

• [ ] Security reviewer has reviewed the evidence.

• [ ] Release owner has reviewed the evidence.

• [ ] Operator lead signs off.

Final decision:

Approved for production smart-contract activation: yes | no
Approver:
Date:
Conditions: