Polkadot is a multichain network in which a relay chain provides shared security to connected chains, called parachains, that communicate through a common message format (XCM). A project can deploy smart contracts on a parachain that supports them, or build its own runtime logic. The review scope differs greatly between these two options.
Building on Polkadot
Chains are built with the Polkadot SDK (formerly Substrate) in Rust, with logic organized in FRAME pallets that form the chain's runtime. Smart contracts can be written in ink!, a Rust-based language compiled to WebAssembly, on chains that support it, or in Solidity on EVM-compatible parachains. XCM messages carry assets and instructions between chains.
- Languages: Rust for runtimes and ink! contracts, Solidity on EVM-compatible parachains
- Tooling: the Polkadot SDK, cargo-contract for ink!, standard EVM frameworks where applicable
- The execution model depends on the chain you deploy to
What auditors look at
- Runtime pallets: weights and benchmarking, panics, unbounded storage and origin checks on calls
- XCM configuration: which origins and assets are trusted, barriers, fee payment and asset reserves
- Runtime upgrades and storage migrations that could corrupt existing state
- ink! contracts: arithmetic, cross-contract calls, reentrancy settings and upgrade mechanisms
- EVM-specific risks where contracts run on an EVM-compatible parachain
Before requesting quotes
- State whether you deliver pallets, a full runtime, ink! contracts or Solidity contracts, and the target chain
- Share the SDK or ink! version and the runtime configuration if relevant
- Describe cross-chain flows and the assets they move
- Provide tests and benchmarks for pallets, and explain how upgrades will be governed