Protocol Security & Auditing — Why this matters

Capital at riskOne unchecked external call can drain funds; the fixes are often simple once you look for them.

A distributed system is one in which the failure of a computer you didn’t even know existed can render your own computer unusable.

— Leslie Lamport

Bugs aren’t secrets—they’re patterns you either hunted or ignored.

— Audit playbook

Repeatable flowThreat models, checklists, and invariants reduce misses when time is short.

Signal vs noiseTools produce noise; a clear checklist keeps you focused on auth, CEI, caps, and accounting before micro-optimizations.

// Quick threat model seed
// Assets: ERC20 in vault
// Adversary: external caller, reentrancy-capable, can frontrun/MEV
// Goals: steal assets, freeze withdrawals, grief accounting
// Entry points: deposit, withdraw, admin setters
// Controls to check: auth, CEI, caps, pause, nonReentrant, invariants

Write this before reading code to guide your checklist and tests.