How to Create a Smart Contract — The Complete Process From Specification to Mainnet

Step 1: Write the Specification (Week 1–2)

Before any code is written, document in plain English exactly what the contract must do. The specification is the source of truth for the development team, the auditor, and the business stakeholders.

The specification prevents the most expensive smart contract error: building the wrong thing.

Step 2: Choose the Development Environment (Day 1)

Foundry is the current professional standard. Install with:

curl -L https://foundry.paradigm.xyz | bash
foundryup

# Create a new project
forge init my-contract

Directory structure:

Step 3: Install OpenZeppelin (Day 1)

Never reimplement standard patterns from scratch. OpenZeppelin provides audited implementations of every major token standard and security utility.

forge install OpenZeppelin/openzeppelin-contracts

Add to `foundry.toml`:

remappings = ["@openzeppelin/=lib/openzeppelin-contracts/"]

Step 4: Write the Contract (Weeks 2–6 depending on complexity)

Simple ERC-20 token example:

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

import "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import "@openzeppelin/contracts/access/Ownable.sol";

contract MyToken is ERC20, Ownable {
    uint256 public constant MAX_SUPPLY = 100_000_000 * 10**18;

    constructor(address initialOwner)
        ERC20("MyToken", "MTK")
        Ownable(initialOwner)
    {}

    function mint(address to, uint256 amount) external onlyOwner {
        require(totalSupply() + amount <= MAX_SUPPLY, "Exceeds max supply");
        _mint(to, amount);
    }
}

Key practices: explicit Solidity version, SPDX license, OpenZeppelin base, checks before effects, custom error messages.

Step 5: Write Tests (Weeks 2–6, concurrent with development)

Tests are written in Solidity using Foundry's `forge-std` library. Target: 95%+ line coverage, 90%+ branch coverage.

// test/MyToken.t.sol
pragma solidity ^0.8.20;

import "forge-std/Test.sol";
import "../src/MyToken.sol";

contract MyTokenTest is Test {
    MyToken token;
    address owner = address(1);
    address user = address(2);

    function setUp() public {
        vm.prank(owner);
        token = new MyToken(owner);
    }

    function test_MintWithinMaxSupply() public {
        vm.prank(owner);
        token.mint(user, 1000 * 10**18);
        assertEq(token.balanceOf(user), 1000 * 10**18);
    }

    function test_RevertWhenMintExceedsMaxSupply() public {
        vm.prank(owner);
        vm.expectRevert("Exceeds max supply");
        token.mint(user, 100_000_001 * 10**18);
    }

    function test_RevertWhenNonOwnerMints() public {
        vm.prank(user);
        vm.expectRevert();
        token.mint(user, 1000 * 10**18);
    }

    // Fuzz test
    function testFuzz_MintAmount(uint256 amount) public {
        amount = bound(amount, 1, token.MAX_SUPPLY());
        vm.prank(owner);
        token.mint(user, amount);
        assertEq(token.balanceOf(user), amount);
    }
}

Run tests: `forge test -vv`

Check coverage: `forge coverage`

Step 6: Run Automated Security Analysis (Week 6)

Slither (static analysis — catches 70%+ of common vulnerability patterns):

pip install slither-analyzer
slither src/MyToken.sol

Review all findings. Fix any High or Medium severity findings before external audit.

Mythril (symbolic execution):

pip install mythril
myth analyze src/MyToken.sol

Step 7: External Security Audit (Weeks 7–10)

Code freeze before audit begins. Provide the auditor with: specification document, test suite results (coverage report), automated analysis results, and any known issues.

The auditor performs manual review, economic attack modeling (for DeFi), and produces a findings report. Remediate all Critical and High findings. Request re-audit of all remediated findings.

Step 8: Deploy to Testnet (Week 10)

Deploy to the appropriate testnet (Sepolia for Ethereum, Mumbai for Polygon) using the verified final code. Run integration tests against the testnet deployment.

forge script script/Deploy.s.sol --rpc-url $SEPOLIA_RPC --broadcast --verify

Step 9: Deploy to Mainnet (Week 11)

Deploy from the code commit that was audited — not any subsequent modification. Verify the contract source on Etherscan immediately after deployment.

forge script script/Deploy.s.sol --rpc-url $MAINNET_RPC --broadcast --verify

Document: transaction hash, deployed contract address, block number, constructor arguments.