The Rekt Test

Originally created by Trail of Bits, the Rekt Test is 12 security questions every protocol team should be able to answer before going to mainnet.

Check each item honestly — this assessment is for you, not us. Nothing is sent anywhere.

Your Score 0 / 12

Check items to see your score

Documentation & Process

Do you have all actors, roles, and privileges documented?

Why it matters:

Undocumented privileges are the #1 source of access control bugs. If you can't list every role and what it can do, neither can your auditor — and attackers will find the gaps first.

What passing looks like:

A maintained access control matrix covering every role, contract, and privileged function in your system.

Do you keep documentation of all the external services, contracts, and oracles you rely on?

Why it matters:

External dependencies are trust assumptions. If an oracle gets compromised or a third-party contract upgrades, your protocol inherits that risk. You need to know your attack surface.

What passing looks like:

A dependency map listing every external call, oracle feed, and third-party contract — with risk assessments for each.

Do you have a written and tested incident response plan?

Why it matters:

When an exploit hits, you have minutes to respond. Teams without a plan waste critical time deciding who does what while funds drain.

What passing looks like:

A documented runbook covering: who gets paged, pause mechanisms, communication channels, and recovery steps — tested in a tabletop exercise.

Do you document the best ways to attack your system?

Why it matters:

If you haven't thought about how to break your own system, you're leaving that exercise to attackers. Threat modeling forces you to think adversarially before someone else does.

What passing looks like:

A threat model covering attack vectors, economic exploits, governance attacks, and oracle manipulation specific to your protocol.

Team & Operations

Do you perform identity verification and background checks on all employees?

Why it matters:

Insider threats are real in crypto. The Ronin bridge hack ($625M) involved compromised employee credentials. Know who has access to your systems.

What passing looks like:

Identity verification and background checks completed for all team members with access to production systems or funds.

Do you have a team member with security defined in their role?

Why it matters:

Security that's "everyone's job" is nobody's job. You need someone accountable for security decisions, audit coordination, and incident response.

What passing looks like:

At least one team member whose role explicitly includes security responsibilities, with time allocated for it.

Do you require hardware security keys for production systems?

Why it matters:

Phishing attacks bypass passwords and SMS 2FA. Hardware keys (YubiKey, Ledger) are the only reliable defense against credential theft targeting your team.

What passing looks like:

Hardware security keys required for all production access: cloud infrastructure, deployment pipelines, admin functions, and treasury wallets.

Does your key management system require multiple humans and physical steps?

Why it matters:

Single points of failure in key management have caused billions in losses. If one compromised person or one stolen key can drain funds, your security is illusory.

What passing looks like:

Multisig wallets for all treasury and admin operations, with geographically distributed signers and a threshold that survives any single compromise.

Code & Testing

Do you define key invariants for your system and test them on every commit?

Why it matters:

Invariants are the rules that must always be true (e.g., "total deposits >= total withdrawals"). If you can't state them, you can't test them — and breaking an invariant is usually an exploit.

What passing looks like:

Documented invariants with automated fuzz/property tests that run in CI on every commit.

Do you use the best automated tools to discover security issues in your code?

Why it matters:

Static analysis tools like Slither catch ~80% of common vulnerability patterns for free and in seconds. Shipping without running them is leaving money on the table.

What passing looks like:

Slither (or equivalent) integrated into CI, with all high/medium findings addressed. Bonus: fuzz testing with Echidna or Foundry.

External Validation

Do you undergo external audits and maintain a vulnerability disclosure or bug bounty program?

Why it matters:

Internal review has blind spots. External auditors and bug bounty hunters find vulnerabilities your team can't see because they approach your code without your assumptions.

What passing looks like:

At least one completed external audit from a reputable firm, plus an active bug bounty program (Immunefi recommended) with meaningful rewards.

Have you considered and mitigated avenues for abusing users of your system?

Why it matters:

Security isn't just about your contracts — it's about your users. Front-running, sandwich attacks, phishing through your UI, and economic manipulation can all harm users even when your code is technically "correct."

What passing looks like:

Documented user-facing risks with mitigations: MEV protection, transaction simulation, clear approval flows, and user education.

You Pass the Rekt Test

Strong security posture. Keep it up — security is ongoing, not one-time.

Getting There

You have some security foundations, but gaps remain. Address the unchecked items before mainnet.

Not Ready Yet

Significant security gaps. You need professional help before going to mainnet.

Need Help Passing?

If you can't confidently check most of these boxes, let us match you with an auditor who can get you there.

Get Matched With an Auditor

The Rekt Test was created by Trail of Bits. This interactive version is provided for educational purposes with full attribution.