Ethereum is the reference smart contract platform: a proof-of-stake blockchain whose execution environment, the Ethereum Virtual Machine (EVM), has been adopted by many other networks. Building on Ethereum gives a project the deepest pool of tooling, libraries and experienced reviewers, but also exposes it to an adversarial environment where every transaction is public and value on mainnet attracts sophisticated attackers.
Building on Ethereum
Contracts are compiled to EVM bytecode and run in an account-based model: each contract has its own storage, and every state change costs gas paid by the caller. Solidity is the dominant language, with Vyper as a smaller alternative focused on simplicity. Deployed code is immutable unless the project adopts an upgradeable proxy pattern, which adds its own governance and storage layout questions.
- Languages: Solidity, Vyper
- Frameworks: Foundry, Hardhat
- Common building blocks: audited standard libraries for tokens (ERC-20, ERC-721, ERC-1155), access control and proxies
What auditors look at
- Reentrancy and the order of external calls versus state updates, including through token callbacks
- Access control on privileged functions, ownership transfer, multisig and timelock configuration
- Oracle usage and price manipulation, especially where flash loans can move a market within one transaction
- Front-running and MEV exposure: slippage limits, deadlines, commit and reveal where ordering matters
- Upgradeable proxies: initializer protection, storage layout collisions and who can trigger an upgrade
Before requesting quotes
- Freeze a commit hash and share the list of files in scope, with the nSLOC count if you have it
- Document the intended roles, privileged actions and trust assumptions (admin keys, oracles, external protocols)
- Provide a working Foundry or Hardhat test suite, ideally with fuzzing or invariant tests on core accounting
- State which networks you will deploy to, since the same code may later run on other EVM chains