How do you prepare a codebase for a security audit, and what happens after the audit?
What the interviewer wants to hear
- Freeze scope and code, with clear documentation and specifications
- High test coverage including fuzz and invariant tests
- Run static analysis and fix known issues first
- Explain trust assumptions, roles and known risks
- Fix findings, get fixes reviewed, publish report
- Ongoing security: bug bounty, monitoring, incident plan
Model answer
An audit is far more effective when auditors spend time on deep logic instead of basics. Before it starts, I freeze a specific commit and define the scope clearly. I write documentation: what the protocol does, architecture diagrams, every role and its powers, external dependencies, trust assumptions, and the invariants that must always hold. Test coverage should be high, with fuzz and invariant tests that encode those properties. I run Slither and other tools and fix obvious issues first, plus an internal review. During the audit, the team answers questions quickly. Afterwards, we fix each finding or document why we accept the risk, and the auditors review the fixes, since fixes can introduce new bugs. The final report is published. An audit does not guarantee safety, so we also launch with caps, set up a bug bounty such as on Immunefi, real-time monitoring, and an incident response plan with pause controls.
Can you answer it under time pressure?
Take a timed hard round and get scored on every answer.
More hard Blockchain Developer questions
- You are designing a new lending protocol. What are the biggest security risks and how do you address them?
- Why have cross-chain bridges been a common target for large hacks, and how would you design a safer cross-chain system?
- What is MEV, and how would you protect your protocol's users from harmful MEV?
- How do you decide what logic and data should live on chain versus off chain in a dApp?
- Your protocol is being exploited right now on mainnet. What do you do in the first hour and afterwards?
- How does EIP-7702 change assumptions that smart contracts and dApps make about EOAs, and what would you change in your code?
- How do you make sure an upgrade to a proxy-based contract does not corrupt storage or break the system?
- You are building an ERC-4626 yield vault. What design and security issues do you consider?
- Your team wants to deploy the same protocol to five EVM chains, including L2s. What can go wrong and how do you prepare?