Live Preview
Template Structure
Blockchain Project Launch Readiness Checklist — What Must Be Complete Before Mainnet
Launch too early and you risk an exploit. Launch too late and you lose market opportunity. Here is the complete launch readiness checklist from specification through deployment.
Format
Document
Sections
13
Format
Document
Status
Ready to customize
Specification Phase ✓
Section 2
Technical Specification Document written and approved by all stakeholders
Every smart contract function described in plain English
All edge cases documented (what happens on boundary conditions)
Invariants defined (what must always be true regardless of inputs)
Access control model reviewed by business stakeholders
Economic model (if applicable) stress-tested against bear market scenarios
Regulatory review completed (FinCEN, SEC, state requirements)
Legal counsel signoff for any token issuance or money transmission
Development Phase ✓
Section 4
Contract code peer-reviewed internally (not by original author)
Test suite coverage: 95%+ line, 90%+ branch
All specification requirements have at least one test
All edge cases have explicit tests
Fuzz testing on all arithmetic functions
Invariant tests for all protocol invariants
No hardcoded addresses or keys in code
All admin functions access-controlled
ReentrancyGuard on all external-facing state-modifying functions
Slither analysis run, all High findings addressed
Mythril analysis run, all findings reviewed
Audit Phase ✓
Section 6
Audit firm selected (recognized, named engineers, published past reports)
Code frozen at the audited commit
Specification provided to auditor
Test coverage report provided to auditor
Kickoff call with auditor completed
All Critical findings remediated
All High findings remediated
Re-audit confirmation received for all remediated findings
Final audit report published
Pre-Deployment ✓
Section 8
Testnet deployment and testing completed
All integration tests pass against testnet
Admin key management confirmed (multi-sig, not single key)
TimelockController configured for upgrades (minimum 48 hours)
Gnosis Safe signers confirmed and tested
Monitoring configured (Tenderly alerts for critical events)
Bug bounty program listed on Immunefi (before or at launch)
Incident response plan written and distributed to team
Emergency contact list (who to call if exploit detected)
Deployment ✓
Section 10
Deploy from the exact audited commit (not any subsequent modification)
Verify contract source on Etherscan/block explorer immediately
Record: deployment transaction hash, contract address, block number, constructor arguments
Test every contract function on mainnet with small amounts
Confirm all access controls work correctly on mainnet
Confirm monitoring alerts are firing correctly
Post-Launch ✓
Section 12
Announce audit report publication with link
For DeFi: TVL cap in place for first 90 days
Bug bounty communicated to security community
Tenderly monitoring confirmed active
On-call schedule for first 7 days post-launch confirmed
Post-launch support engineer assigned and briefed
What Skipping Any Item Means
Skipping specification: Guaranteed scope dispute and likely wrong product. Skipping invariant tests: Undiscovered vulnerabilities that auditors may not catch. Skipping audit: Risk of complete loss of user funds to exploit. Skipping timelock: Single exploit or governance attack can drain protocol. Skipping monitoring: Exploits run undetected for hours or days before manual discovery.
Template Guide
How to use this template
Template Overview
Launch too early and you risk an exploit. Launch too late and you lose market opportunity. Here is the complete launch readiness checklist from specification through deployment.
Specification Phase ✓
Technical Specification Document written and approved by all stakeholders
Every smart contract function described in plain English
All edge cases documented (what happens on boundary conditions)
Invariants defined (what must always be true regardless of inputs)
Access control model reviewed by business stakeholders
Economic model (if applicable) stress-tested against bear market scenarios
Regulatory review completed (FinCEN, SEC, state requirements)
Legal counsel signoff for any token issuance or money transmission
Development Phase ✓
Contract code peer-reviewed internally (not by original author)
Test suite coverage: 95%+ line, 90%+ branch
All specification requirements have at least one test
All edge cases have explicit tests
Fuzz testing on all arithmetic functions
Invariant tests for all protocol invariants
No hardcoded addresses or keys in code
All admin functions access-controlled
ReentrancyGuard on all external-facing state-modifying functions
Slither analysis run, all High findings addressed
Mythril analysis run, all findings reviewed
Audit Phase ✓
Audit firm selected (recognized, named engineers, published past reports)
Code frozen at the audited commit
Specification provided to auditor
Test coverage report provided to auditor
Kickoff call with auditor completed
All Critical findings remediated
All High findings remediated
Re-audit confirmation received for all remediated findings
Final audit report published
Pre-Deployment ✓
Testnet deployment and testing completed
All integration tests pass against testnet
Admin key management confirmed (multi-sig, not single key)
TimelockController configured for upgrades (minimum 48 hours)
Gnosis Safe signers confirmed and tested
Monitoring configured (Tenderly alerts for critical events)
Bug bounty program listed on Immunefi (before or at launch)
Incident response plan written and distributed to team
Emergency contact list (who to call if exploit detected)
Deployment ✓
Deploy from the exact audited commit (not any subsequent modification)
Verify contract source on Etherscan/block explorer immediately
Record: deployment transaction hash, contract address, block number, constructor arguments
Test every contract function on mainnet with small amounts
Confirm all access controls work correctly on mainnet
Confirm monitoring alerts are firing correctly
Post-Launch ✓
Announce audit report publication with link
For DeFi: TVL cap in place for first 90 days
Bug bounty communicated to security community
Tenderly monitoring confirmed active
On-call schedule for first 7 days post-launch confirmed
Post-launch support engineer assigned and briefed
What Skipping Any Item Means
Skipping specification: Guaranteed scope dispute and likely wrong product. Skipping invariant tests: Undiscovered vulnerabilities that auditors may not catch. Skipping audit: Risk of complete loss of user funds to exploit. Skipping timelock: Single exploit or governance attack can drain protocol. Skipping monitoring: Exploits run undetected for hours or days before manual discovery.