Low-severity findings are won before the audit. The teams that sail through review share a habit: they threat-model first, write invariants alongside implementation, and document every tradeoff where an auditor will look for it.
The eight gates
- Access scoping — every privileged function mapped to a role, with no admin-shaped surprises.
- Oracle guards — deviation bands, staleness checks and fallback pricing specified in writing.
- Reentrancy discipline — checks-effects-interactions plus targeted invariant attacks.
- Upgrade paths — UUPS or immutable by decision, never by accident; storage gaps verified.
- Gas ceilings — worst-case paths profiled so peak load never bricks a function.
- Event completeness — every state change observable for indexers and monitors.
- Pause design — who can pause, what pauses, and the unpause path rehearsed.
- Deployment ceremony — keys, parameters and verification rehearsed on testnet.
Run this two sprints before you book auditors. You will cut review rounds and keep findings cosmetic — which is exactly where they belong.
Related: dApp architecture · DeFi engineering lessons · Smart contract services