Building and auditing on Avalanche: the EVM-compatible C-Chain, custom chains with their own rules, cross-chain messaging risks and how to prepare.
Avalanche is a proof-of-stake network known for fast finality, made of a primary network and custom blockchains that projects can launch with their own validators and rules. Most smart contracts run on the C-Chain, which is EVM-compatible. A project can therefore start with familiar Ethereum tooling, and later consider a dedicated chain if it needs its own fee token, permissions or performance settings.
Building on Avalanche
On the C-Chain, contracts are written in Solidity or Vyper and deployed with standard EVM frameworks. Custom chains can also run an EVM, sometimes extended with precompiled contracts that add native features such as allow lists or fee configuration. Avalanche provides native messaging between its chains, which projects use to move assets or instructions across them.
Languages: Solidity, Vyper
Frameworks: Foundry, Hardhat
Custom chains: EVM configuration, precompiles and validator management are part of the scope
What auditors look at
Cross-chain messaging: verification of the source chain and sender, replay protection, and failure handling
Custom chain configuration: precompiles, allow lists, fee settings and who can change them
Bridged assets and the trust placed in the bridge that issued them
Assumptions about fast finality in off-chain services and keepers
Standard EVM risks: reentrancy, oracle manipulation, access control and upgradeable proxies
Before requesting quotes
State whether you deploy on the C-Chain, on a custom chain, or both
For a custom chain, share its genesis configuration and the list of enabled precompiles
Describe every cross-chain flow and the contracts at each end
Provide the commit hash, scope and test suite, including tests for cross-chain messages