Solana pre-audit readiness score

Is every upgrade, mint, freeze, and admin authority listed, with its current holder and a rotation plan?

An authority nobody listed is one nobody watches, and one key can change or drain the program.

Are privileged authorities held by a multisig with named signers, not a single wallet?

A single hot wallet turns one phished laptop into control of the program.

Is there a written runbook for a compromised key, and has anyone walked through it?

During an incident people guess. A rehearsed runbook shortens the time an attacker has.

Does every instruction check each account for owner, signer, writable, and PDA seeds?

Missing owner or signer checks are among the most common Solana exploit classes: a caller passes an account the program trusts by mistake.

Does every cross-program call verify the target program id before invoking it?

An unchecked program id lets a caller swap in their own program and run it with your signer seeds.

Are account close and re-initialize paths tested against replay and revival in the same transaction?

A closed account that can be revived or reinitialized can reset state the program assumes is final.

Does arithmetic on balances and shares use checked operations, with overflow and underflow tests?

Wrapping math in release builds can mint or hide value without any error.

Are the economic invariants written down and enforced as tests, such as vault balance matching recorded shares?

An auditor can only check behavior against intent. Invariants written as tests state that intent.

Do fuzz or property tests exercise instruction inputs and account combinations?

Hand-written cases cover what you thought of. Generated inputs find the case you did not.

Has the upgrade path been rehearsed on a mainnet fork or devnet, including a rollback?

The first real upgrade is a bad time to learn a buffer account or authority step was wrong.

Are there alerts on authority use and on vault balance drift?

Authority use and unexplained balance changes are often the first visible sign of a problem.

Is the upgrade authority decision recorded: kept behind a multisig, time-locked, or revoked, and why?

Users and auditors need to know whether the code can still change, and who decides.