Smart Contracts & DApps: Audit, Deploy, Maintain

Smart Contracts & DApps: Audit, Deployment, and Maintenance

We often encounter clients who come with the idea of "launching a blockchain project" but cannot clearly articulate why they need a blockchain. The key question: what exactly does blockchain solve in your product that a traditional database does not? If the answer is vague—you probably just need a distributed system, not a blockchain. If the answer is clear—trustless execution of logic, verifiable data, tokenization of assets, permissionless participation—we start designing. Our team has 10+ years of experience in blockchain development and has completed over 50 projects—from NFT marketplaces to DeFi protocols with over $10M in TVL. We offer a full-cycle turnkey development: from architecture to deployment and audit. Budget estimation is the first step in any project, and we always conduct it during the initial consultation.

How to Choose a Blockchain for Your Project?

There is no "best blockchain"—only the right one for a specific use case.

EVM-compatible Networks

Ethereum mainnet—maximum decentralization and security, first-class development tooling (Foundry, Hardhat, Slither, Echidna). Justified for: protocols with large TVL where security outweighs cost; financial primitives that must be composable with the DeFi ecosystem.

Arbitrum / Optimism—Optimistic Rollups. EVM equivalence (Arbitrum One) or EVM compatibility (OP Stack). Gas is 10–50x cheaper than mainnet, finality ~7 days for withdrawals (fraud proof window). Justified for high-frequency transactions: trading, gaming, social applications.

Base—OP Stack L2 from Coinbase. Rapidly growing ecosystem, good onramp via Coinbase. Suitable for consumer-facing applications.

Polygon PoS—not an L2, but a sidechain with a bridge to Ethereum. Fast, cheap, but a different security model. Good for NFT projects with frequent transactions.

zkSync Era / Polygon zkEVM / Scroll—ZK Rollups. Stronger security guarantees than Optimistic (no fraud window), but ZK proofs create overhead on execution. zkSync has Native Account Abstraction (AA) at the protocol level—an important architectural advantage for UX.

Non-EVM

Solana—high throughput (65k TPS theoretically, ~3–5k TPS real), parallel transaction execution via Sealevel, low fees. Programming in Rust with the Anchor framework. Tooling is significantly less mature than EVM; the debugger is primitive, errors are harder to read. Justified for: high-frequency trading, gaming with real-time mechanics, applications where gas cost is critical.

TON—native integration with Telegram (900M MAU). Smart contracts in FunC/Tact. If your audience is on Telegram—a strong argument for TON.

Cosmos SDK—for cases requiring your own blockchain (application-specific chain). IBC for cross-chain communication. High entry threshold but full control over consensus, governance, and gas token.

What Smart Contract Vulnerabilities Are Most Common?

From years of audit work, here are the most frequent issues:

Reentrancy—a classic. Still occurs. Protection: ReentrancyGuard from OpenZeppelin + CEI pattern (Checks-Effects-Interactions):

// INCORRECT: function withdraw(uint256 amount) external { token.transfer(msg.sender, amount); // interaction before effect balances[msg.sender] -= amount; // effect after } // CORRECT: function withdraw(uint256 amount) external nonReentrant { balances[msg.sender] -= amount; // effect token.transfer(msg.sender, amount); // interaction } 

Price manipulation via flash loans—if the contract reads the price from the Uniswap spot price. Solution: TWAP (Time-Weighted Average Price) via IUniswapV3Pool.observe() or Chainlink Price Feed.

Integer overflow/underflow—in Solidity 0.8.x built-in protection, but still relevant with unchecked blocks and custom arithmetic with downcast.

Signature replay—when using ecrecover without a nonce or chain ID in the signed message. EIP-712 + EIP-2612 (Permit) solve this in a standard way.

Front-running—MEV. For AMM-like contracts: deadline + slippage tolerance. For sensitive operations: commit-reveal scheme.

What Tools Do We Use?

Foundry—preferred tool for serious development. Tests in Solidity, built-in fuzz testing, mainnet forking with a single flag:

forge test --fork-url $ETH_RPC --fork-block-number 19000000 -vvv 

Fuzz testing finds edge cases that manual tests miss:

function testFuzz_deposit(uint256 amount) public { amount = bound(amount, 1, type(uint128).max); // reasonable bounds deal(address(token), user, amount); vm.prank(user); vault.deposit(amount, user); assertEq(vault.totalAssets(), amount); } 

Slither—static analyzer. We run it in CI on every PR; critical findings block merging.

Echidna—property-based fuzzer. For invariants: "totalSupply always equals the sum of all balances", "protocol health never goes negative".

OpenZeppelin Security Audits recommends combining multiple tools to cover different vulnerability types.

What Does a Typical Deployment Stack Look Like?

No deployments from EOA in production. Schema:

Developer EOA → Gnosis Safe 3/5 multisig → Timelock (48h delay) → Contract 

A timelock gives users time to react to a malicious upgrade. For DeFi protocols with TVL > $1M—mandatory.

Hardhat Ignition or Foundry Deploy Scripts for reproducible deployments. All deployment parameters are in version control, not in developers' heads.

Audit—not a final step but part of the process. For serious protocols: internal review (Slither + Echidna + manual analysis) → preliminary audit by one firm → main audit → fix findings → re-audit of changes. Timeline: 4–8 weeks for a typical medium-complexity DeFi protocol. Budget is calculated individually.

How We Develop: Step by Step

1. Requirements analysis and network selection. Determine which blockchain best suits your use case, considering tokenomics, expected load, and legal aspects.
2. Contract architecture design. Develop interaction diagrams, interface specifications, and data schemas.
3. Smart contract development. Write code in Solidity or Rust, cover with unit tests (100% coverage).
4. Integration testing. Fork mainnet and verify full scenarios.
5. External audit. Hand over code to a trusted firm, fix findings, re-audit.
6. Deployment to testnet and mainnet. Use multisig wallets and timelocks.
7. Monitoring and support. Set up Tenderly, OpenZeppelin Defender, provide 30 days post-deployment support.

Project Phases

Realistic timeline from idea to mainnet: 3–6 months for a medium-complexity protocol. Projects that "launch in 2 weeks" usually have critical unpatched vulnerabilities.

What Is Included in the Work

• Architectural documentation with justification for network and pattern choices.
• Smart contract source code with comments and unit tests (100% coverage).
• Integration tests on mainnet fork.
• External audit report with recommendations.
• Deployment on testnet and mainnet (if required).
• Operational instructions and support for 30 days post-deployment.
• Access to monitoring tools (Tenderly, OpenZeppelin Defender).

Contact us for an assessment of your project. We will analyze the requirements, propose the optimal blockchain architecture, and calculate timelines. Get a consultation—this will help you avoid costly mistakes at the start.