126 smart contract audit checks in one working checklist, severity-rated, for EVM and cross-chain projects. Most audit checklists floating around are either a blog post with 20 vague bullets or a firm's internal template you can't read. This one ships as a spreadsheet you work through: every check has a stable id (AC-01, RE-04...), a severity (CRIT / HIGH / MED / LOW / INFO) and a reference (SWC ids from the SWC registry where one applies). What's covered: - Access control & authorization (15): role checks, tx.origin, two-step ownership, initializer protection - Reentrancy & external calls (12): check-effects-interactions, cross-function and read-only reentrancy, unchecked return values - Oracle & data feeds (12): feed freshness, L2 sequencer uptime check, deviation bounds, no spot-price valuation - Token standards (22): ERC20 oddities (USDT-style returns, fee-on-transfer, permit replay), ERC721/1155 hooks, supply caps - Bridge & cross-chain messaging (11): replay protection, signature malleability, rate limits, custody invariants - Upgradeability (12): storage layout, UUPS authorization, initializer semantics, timelocks - Front-running & MEV (11): slippage/deadline guards, first-depositor share inflation, keeper rewards - Gas & optimization (9): the ones that matter, plus the gas-DoS traps - Event coverage (9): what must emit, what belongs in storage instead - Admin & multisig hygiene (13): thresholds, timelocks, key rotation, no user-fund backdoors Formats: PDF for review sessions, CSV for tracking in Notion/Sheets/Excel, Markdown grouped by category. Honest limits: it's a manual review aid built on public SWC registry entries and audit practice patterns. It is not an audit, and working through it doesn't make code safe. Severity = worst case if the check fails. License: personal + commercial use, including client work. No resale or redistribution of the files as-is.