{"id":5568,"date":"2026-10-22T13:08:28","date_gmt":"2026-10-22T13:08:28","guid":{"rendered":"https:\/\/www.coindeveloperindia.com\/blog\/?p=5568"},"modified":"2026-10-22T13:55:03","modified_gmt":"2026-10-22T13:55:03","slug":"ico-smart-contract-development-guide","status":"publish","type":"post","link":"https:\/\/www.coindeveloperindia.com\/blog\/ico-smart-contract-development-guide\/","title":{"rendered":"ICO Smart Contract Development: Complete Technical Guide"},"content":{"rendered":"<div class=\"cdi-blog\">\n<p>In a token sale, the smart contract is the core of the business. It holds investor funds, enforces the rules, and cannot be recalled once deployed. A flaw is not a bug report. It is a permanent, public, financial event.<\/p>\n<p>This guide covers <a href=\"https:\/\/www.coindeveloperindia.com\/blog\/what-is-an-ico\/\">ICO<\/a> smart contract development end to end: architecture, token and sale contract design, vesting, security, testing, audits, deployment, and Solana. Code samples use current OpenZeppelin contracts v5 patterns, are educational only, and are not audited for production use.<\/p>\n<div style=\"background: #0b1f3a; color: #fff; padding: 25px; border-left: 6px solid #f59e0b; border-radius: 10px; margin: 30px 0;\">\n<p style=\"margin-top: 0; color: #fbbf24;\">Key Takeaways<\/p>\n<ul style=\"font-size: 18px; line-height: 1.8; margin: 0 0 20px 0; padding-left: 24px;\">\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\">A complete ICO system is several small, focused contracts, not one large one.<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\">Fewer privileged roles mean a smaller attack surface and a stronger trust story.<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\">Pull-based claims, refunds, and withdrawals are safer than pushing funds to many addresses, or tying fund transfers to state changes.<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\">Testing must cover failure paths (soft cap missed, refunds, underfunded sale), not only the happy path.<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\">An independent audit reduces risk but does not eliminate it. Every material fix should be re-audited.<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\">Solana projects use a different language, account model, and toolchain from EVM chains, and need a separate audit.<\/li>\n<\/ul>\n<\/div>\n<div style=\"background: #f7f9fa; border: 1px solid #e3e8ec; border-radius: 18px; padding: 25px 30px; margin: 40px 0;\">\n<p style=\"margin-top: 0; margin-bottom: 18px; color: #b45309; font-size: 22px; font-weight: bold;\">In This Guide<\/p>\n<ol style=\"font-size: 18px; line-height: 1.8; margin: 0; padding-left: 24px;\">\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\"><a href=\"#what-is\">What is ICO smart contract development?<\/a><\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\"><a href=\"#architecture\">Architecture, chain choice, and tooling<\/a><\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\"><a href=\"#stage-1\">Stage 1: The token contract<\/a><\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\"><a href=\"#stage-2\">Stage 2: The sale contract<\/a><\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\"><a href=\"#stage-3\">Stage 3: Vesting contracts<\/a><\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\"><a href=\"#stage-4\">Stage 4: Access control, admin functions, and upgradeability<\/a><\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\"><a href=\"#oracles\">Multi-asset sales and price oracles<\/a><\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\"><a href=\"#solana\">Solana: building a token sale program<\/a><\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\"><a href=\"#security\">Security: vulnerabilities and mitigations<\/a><\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\"><a href=\"#testing\">Testing before the audit<\/a><\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\"><a href=\"#audit\">The audit process<\/a><\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\"><a href=\"#deployment\">Deployment and verification<\/a><\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\"><a href=\"#cost\">Cost and timeline factors<\/a><\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\"><a href=\"#partner\">Choosing a development partner<\/a><\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\"><a href=\"#checklist\">Pre-audit checklist, common mistakes, and FAQ<\/a><\/li>\n<\/ol>\n<\/div>\n<h2 id=\"what-is\">What Is ICO Smart Contract Development?<\/h2>\n<p>ICO <a href=\"https:\/\/www.coindeveloperindia.com\/smart-contract-development\">smart contract development<\/a> is the engineering of the on-chain programs that create a token, accept contributions, enforce sale rules, and distribute tokens to investors. A standard ICO system includes a token contract, a sale (crowdsale) contract, vesting contracts, whitelist and access control, and a multi-signature treasury, all tested, independently audited, and verified on a block explorer before launch.<\/p>\n<p>On EVM chains this work is done in Solidity with libraries such as <a href=\"https:\/\/docs.openzeppelin.com\/contracts\">OpenZeppelin Contracts<\/a>. On Solana it is done in Rust, usually with the <a href=\"https:\/\/www.anchor-lang.com\/docs\">Anchor<\/a> framework.<\/p>\n<h2 id=\"architecture\">ICO Smart Contract Architecture at a Glance<\/h2>\n<div class=\"custom-table-wrapper\" style=\"overflow-x: auto; margin: 20px 0;\">\n<table class=\"custom-comparison-table\" style=\"width: 100%; margin-top: 0; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 15px;\">\n<thead>\n<tr style=\"background: linear-gradient(90deg,#0f766e,#0e7490); color: #fff;\">\n<th style=\"padding: 14px; border: 1px solid #ddd; text-align: left;\">Component<\/th>\n<th style=\"padding: 14px; border: 1px solid #ddd; text-align: left;\">Responsibility<\/th>\n<th style=\"padding: 14px; border: 1px solid #ddd; text-align: left;\">Key design decisions<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr style=\"background: #fff;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Token contract<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Defines the asset (supply, transfers, burning)<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Standard (ERC-20), fixed or capped supply, no hidden mint<\/td>\n<\/tr>\n<tr style=\"background: #f3faf9;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Sale contract<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Accepts contributions and enforces sale rules<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Pricing, soft\/hard caps, per-wallet limits, time window, funding checks<\/td>\n<\/tr>\n<tr style=\"background: #fff;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Whitelist \/ access control<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Restricts participation to verified addresses<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Merkle proofs; immutable root (simplest) or an updatable root behind a timelock<\/td>\n<\/tr>\n<tr style=\"background: #f3faf9;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Vesting contracts<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Release locked tokens on a schedule<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Cliff, linear release, beneficiary, revocability (requires custom code)<\/td>\n<\/tr>\n<tr style=\"background: #fff;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Treasury<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Receives raised funds<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Multi-signature wallet, never a single key<\/td>\n<\/tr>\n<tr style=\"background: #f3faf9;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Timelock<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Delays sensitive admin actions<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Delay length, who can propose and execute<\/td>\n<\/tr>\n<tr style=\"background: #fff;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Price oracle (optional)<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Converts multi-asset contributions to a common value<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Decentralized feed, staleness and sanity checks, L2 sequencer checks<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<h2 id=\"chain\">Choosing the Chain and Language<\/h2>\n<div class=\"custom-table-wrapper\" style=\"overflow-x: auto; margin: 20px 0;\">\n<table class=\"custom-comparison-table\" style=\"width: 100%; margin-top: 0; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 15px;\">\n<thead>\n<tr style=\"background: linear-gradient(90deg,#0f766e,#0e7490); color: #fff;\">\n<th style=\"padding: 14px; border: 1px solid #ddd; text-align: left;\">Chain family<\/th>\n<th style=\"padding: 14px; border: 1px solid #ddd; text-align: left;\">Language<\/th>\n<th style=\"padding: 14px; border: 1px solid #ddd; text-align: left;\">Token standard<\/th>\n<th style=\"padding: 14px; border: 1px solid #ddd; text-align: left;\">Typical tooling<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr style=\"background: #fff;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Ethereum and EVM chains (BNB Chain, Polygon, Arbitrum, Optimism, Base)<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Solidity<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">ERC-20, BEP-20<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Foundry, Hardhat, OpenZeppelin<\/td>\n<\/tr>\n<tr style=\"background: #f3faf9;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Solana<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Rust<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">SPL Token \/ Token-2022<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Anchor, Solana CLI<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<p><a href=\"https:\/\/www.coindeveloperindia.com\/blog\/best-blockchains-to-create-your-own-cryptocurrency\/\">EVM chains<\/a> share one contract model, so a well-tested Solidity codebase ports across them with chain-specific configuration, including the EVM target version (see Deployment below). Solana requires a separate implementation. See the Solana section below.<\/p>\n<h2 id=\"stack\">The Development Stack<\/h2>\n<div class=\"custom-table-wrapper\" style=\"overflow-x: auto; margin: 20px 0;\">\n<table class=\"custom-comparison-table\" style=\"width: 100%; margin-top: 0; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 15px;\">\n<thead>\n<tr style=\"background: linear-gradient(90deg,#0f766e,#0e7490); color: #fff;\">\n<th style=\"padding: 14px; border: 1px solid #ddd; text-align: left;\">Layer<\/th>\n<th style=\"padding: 14px; border: 1px solid #ddd; text-align: left;\">Common tools<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr style=\"background: #fff;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Language<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Solidity (EVM), Rust (Solana)<\/td>\n<\/tr>\n<tr style=\"background: #f3faf9;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Libraries<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">OpenZeppelin Contracts<\/td>\n<\/tr>\n<tr style=\"background: #fff;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Frameworks<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><a href=\"https:\/\/book.getfoundry.sh\">Foundry<\/a>, Hardhat<\/td>\n<\/tr>\n<tr style=\"background: #f3faf9;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Testing and analysis<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Forge tests and fuzzing, invariant tests, Slither, Echidna<\/td>\n<\/tr>\n<tr style=\"background: #fff;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Formal verification (high-value logic)<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Certora Prover, Halmos<\/td>\n<\/tr>\n<tr style=\"background: #f3faf9;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Whitelist trees<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><a href=\"https:\/\/github.com\/OpenZeppelin\/merkle-tree\">@openzeppelin\/merkle-tree<\/a><\/td>\n<\/tr>\n<tr style=\"background: #fff;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Treasury security<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Safe (multi-signature wallets)<\/td>\n<\/tr>\n<tr style=\"background: #f3faf9;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Client libraries<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">ethers.js, viem<\/td>\n<\/tr>\n<tr style=\"background: #fff;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Verification<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Block explorer source verification<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<h2 id=\"stage-1\">Stage 1: The Token Contract<\/h2>\n<p>The token contract defines the asset investors receive. For most ICOs, the safest design is the simplest one: a fixed supply minted once to a treasury address, with no mint function afterwards.<\/p>\n<pre style=\"background: #0b1f3a; color: #e5e7eb; padding: 20px; border-radius: 10px; overflow-x: auto; font-size: 14px; line-height: 1.6; margin: 20px 0;\"><code>\/\/ SPDX-License-Identifier: MIT\r\npragma solidity ^0.8.24;\r\n\r\nimport {ERC20} from \"@openzeppelin\/contracts\/token\/ERC20\/ERC20.sol\";\r\nimport {ERC20Burnable} from \"@openzeppelin\/contracts\/token\/ERC20\/extensions\/ERC20Burnable.sol\";\r\nimport {ERC20Permit} from \"@openzeppelin\/contracts\/token\/ERC20\/extensions\/ERC20Permit.sol\";\r\n\r\n\/\/\/ @notice Educational token. Not audited.\r\ncontract ProjectToken is ERC20, ERC20Burnable, ERC20Permit {\r\n    constructor(address treasury, uint256 supply)\r\n        ERC20(\"Project Token\", \"PRJ\")\r\n        ERC20Permit(\"Project Token\")\r\n    {\r\n        require(treasury != address(0), \"zero treasury\");\r\n        _mint(treasury, supply * 10 ** decimals());\r\n    }\r\n}<\/code><\/pre>\n<h3>Why this design works<\/h3>\n<ul style=\"font-size: 18px; line-height: 1.8; margin: 0 0 20px 0; padding-left: 24px;\">\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\"><strong>Fixed supply, no mint function.<\/strong> Investors can verify that supply cannot be inflated.<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\"><strong>Burnable.<\/strong> Holders can reduce supply voluntarily, which supports <a href=\"https:\/\/www.coindeveloperindia.com\/blog\/strengthen-your-ico-with-the-best-token-protocols\/\">deflationary tokenomics<\/a>.<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\">Permit (<a href=\"https:\/\/eips.ethereum.org\/EIPS\/eip-2612\">EIP-2612<\/a>). Allows gasless approvals through signed messages. The token&#8217;s nonces and deadline already prevent replay. Apps that call <code style=\"background: #eef2f6; color: #0b1f3a; padding: 2px 6px; border-radius: 4px; font-size: 0.9em;\">permit()<\/code> should tolerate a front-run permit (for example, wrap the call in try\/catch) so a griefing transaction cannot block the user&#8217;s action.<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\"><strong>No owner.<\/strong> There is no privileged key to compromise.<\/li>\n<\/ul>\n<p>Add features only when the business case demands them. Pausable transfers, blacklists, or mint roles each add an attack surface and a trust question, and each must be disclosed to investors in plain language.<\/p>\n<p>The sale contract below assumes a plain ERC-20 like this one. Fee-on-transfer, rebasing, or other non-standard tokens break its accounting and should not be used as the sale token.<\/p>\n<h2 id=\"stage-2\">Stage 2: The Sale (Crowdsale) Contract<\/h2>\n<p>The token sale smart contract holds investor funds, so it deserves the most scrutiny. The example below is an ERC-20 token sale contract that implements a whitelisted, capped, fixed-price sale with pull-based claims, refunds, and treasury withdrawal; overflow bounds on pricing math; a funding check on every contribution; and accurate recovery of excess tokens.<\/p>\n<h3>Design decisions<\/h3>\n<ul style=\"font-size: 18px; line-height: 1.8; margin: 0 0 20px 0; padding-left: 24px;\">\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\"><strong>No admin keys.<\/strong> Parameters are immutable. <code style=\"background: #eef2f6; color: #0b1f3a; padding: 2px 6px; border-radius: 4px; font-size: 0.9em;\">finalize()<\/code>, <code style=\"background: #eef2f6; color: #0b1f3a; padding: 2px 6px; border-radius: 4px; font-size: 0.9em;\">withdrawRaised()<\/code>, and <code style=\"background: #eef2f6; color: #0b1f3a; padding: 2px 6px; border-radius: 4px; font-size: 0.9em;\">recoverExcessTokens()<\/code> can be called by anyone, and each only moves funds to the buyer or the immutable treasury.<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\"><strong>Pull over push.<\/strong> Buyers claim tokens or refunds themselves, which avoids looping over many addresses. <code style=\"background: #eef2f6; color: #0b1f3a; padding: 2px 6px; border-radius: 4px; font-size: 0.9em;\">finalize()<\/code> only updates state. Moving ETH to the treasury is a separate <code style=\"background: #eef2f6; color: #0b1f3a; padding: 2px 6px; border-radius: 4px; font-size: 0.9em;\">withdrawRaised()<\/code> call, so a problem on the treasury side can never block buyers from claiming or refunding.<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\"><strong>Funded before filled.<\/strong> Every contribution must be fully backed by tokens the contract already holds. An underfunded sale cannot accept money it could not pay out, and nobody can finalize a sale into failure by calling <code style=\"background: #eef2f6; color: #0b1f3a; padding: 2px 6px; border-radius: 4px; font-size: 0.9em;\">finalize()<\/code> before the tokens arrive.<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\"><strong>Overflow-safe rate bounds.<\/strong> The constructor requires a non-zero hard cap and ensures <code style=\"background: #eef2f6; color: #0b1f3a; padding: 2px 6px; border-radius: 4px; font-size: 0.9em;\">rate * hardCap<\/code> cannot overflow <code style=\"background: #eef2f6; color: #0b1f3a; padding: 2px 6px; border-radius: 4px; font-size: 0.9em;\">uint256<\/code>.<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\"><strong>Checks-effects-interactions plus a reentrancy guard.<\/strong> State is updated before any external call.<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\"><strong>Accurate token accounting.<\/strong><code style=\"background: #eef2f6; color: #0b1f3a; padding: 2px 6px; border-radius: 4px; font-size: 0.9em;\">tokensOutstanding<\/code> records what buyers are still owed and falls as they claim, so excess recovery never locks or over-releases tokens.<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\"><strong>Treasury is immutable and must be a multi-signature wallet<\/strong> that can receive ETH. Send a test transfer to it and confirm the address on-chain before deploying, because an immutable treasury that rejects ETH cannot be changed.<\/li>\n<\/ul>\n<pre style=\"background: #0b1f3a; color: #e5e7eb; padding: 20px; border-radius: 10px; overflow-x: auto; font-size: 14px; line-height: 1.6; margin: 20px 0;\"><code>\/\/ SPDX-License-Identifier: MIT\r\npragma solidity ^0.8.24;\r\n\r\nimport {IERC20} from \"@openzeppelin\/contracts\/token\/ERC20\/IERC20.sol\";\r\nimport {SafeERC20} from \"@openzeppelin\/contracts\/token\/ERC20\/utils\/SafeERC20.sol\";\r\nimport {ReentrancyGuard} from \"@openzeppelin\/contracts\/utils\/ReentrancyGuard.sol\";\r\nimport {MerkleProof} from \"@openzeppelin\/contracts\/utils\/cryptography\/MerkleProof.sol\";\r\n\r\n\/\/\/ @notice Educational token sale. Not audited. Do not use it in production without independent review.\r\n\/\/\/ @dev Assumes a plain ERC-20 sale token (no fees on transfer, no rebasing).\r\ncontract TokenSale is ReentrancyGuard {\r\n    using SafeERC20 for IERC20;\r\n\r\n    IERC20 public immutable token;\r\n    address payable public immutable treasury;\r\n    bytes32 public immutable merkleRoot;\r\n    uint256 public immutable rate;         \/\/ token base units per wei (integer)\r\n    uint256 public immutable softCap;      \/\/ in wei\r\n    uint256 public immutable hardCap;      \/\/ in wei\r\n    uint256 public immutable maxPerWallet; \/\/ in wei\r\n    uint256 public immutable minPerWallet; \/\/ in wei (0 = no minimum)\r\n    uint64 public immutable startTime;\r\n    uint64 public immutable endTime;\r\n\r\n    uint256 public totalRaised;\r\n    uint256 public tokensOutstanding; \/\/ tokens buyers can still claim (set at finalize)\r\n    bool public finalized;\r\n    bool public successful;\r\n    bool public fundsWithdrawn;\r\n    mapping(address =&gt; uint256) public contributions;\r\n\r\n    event Contributed(address indexed buyer, uint256 amount);\r\n    event Finalized(bool successful, uint256 totalRaised);\r\n    event Withdrawn(address indexed treasury, uint256 amount);\r\n    event Claimed(address indexed buyer, uint256 tokens);\r\n    event Refunded(address indexed buyer, uint256 amount);\r\n    event ExcessTokensRecovered(address indexed to, uint256 amount);\r\n\r\n    error SaleNotActive();\r\n    error ZeroContribution();\r\n    error BelowMinimum();\r\n    error NotWhitelisted();\r\n    error CapExceeded();\r\n    error SaleUnderfunded();\r\n    error AlreadyFinalized();\r\n    error SaleNotEnded();\r\n    error ClaimUnavailable();\r\n    error RefundUnavailable();\r\n    error WithdrawUnavailable();\r\n    error NothingOwed();\r\n    error TransferFailed();\r\n    error NothingToRecover();\r\n    error RecoverUnavailable();\r\n\r\n    constructor(\r\n        IERC20 token_,\r\n        address payable treasury_,\r\n        bytes32 merkleRoot_,\r\n        uint256 rate_,\r\n        uint256 softCap_,\r\n        uint256 hardCap_,\r\n        uint256 minPerWallet_,\r\n        uint256 maxPerWallet_,\r\n        uint64 startTime_,\r\n        uint64 endTime_\r\n    ) {\r\n        require(address(token_) != address(0) &amp;&amp; treasury_ != address(0), \"zero address\");\r\n        require(rate_ &gt; 0 &amp;&amp; hardCap_ &gt; 0, \"zero rate or cap\");\r\n        require(softCap_ &lt;= hardCap_ &amp;&amp; startTime_ &lt; endTime_, \"bad params\");\r\n        require(minPerWallet_ &lt;= maxPerWallet_, \"min &gt; max\");\r\n        \/\/ Prevent rate * hardCap from overflowing uint256 in funding and claim math.\r\n        require(rate_ &lt;= type(uint256).max \/ hardCap_, \"rate overflow\");\r\n\r\n        token = token_;\r\n        treasury = treasury_;\r\n        merkleRoot = merkleRoot_;\r\n        rate = rate_;\r\n        softCap = softCap_;\r\n        hardCap = hardCap_;\r\n        minPerWallet = minPerWallet_;\r\n        maxPerWallet = maxPerWallet_;\r\n        startTime = startTime_;\r\n        endTime = endTime_;\r\n    }\r\n\r\n    function contribute(bytes32[] calldata proof) external payable nonReentrant {\r\n        if (finalized || block.timestamp &lt; startTime || block.timestamp &gt; endTime) {\r\n            revert SaleNotActive();\r\n        }\r\n        if (msg.value == 0) revert ZeroContribution();\r\n\r\n        \/\/ Matches OpenZeppelin StandardMerkleTree leaf encoding for [\"address\"]\r\n        bytes32 leaf = keccak256(bytes.concat(keccak256(abi.encode(msg.sender))));\r\n        if (!MerkleProof.verifyCalldata(proof, merkleRoot, leaf)) revert NotWhitelisted();\r\n\r\n        uint256 newTotal = totalRaised + msg.value;\r\n        uint256 newPersonal = contributions[msg.sender] + msg.value;\r\n        if (newTotal &gt; hardCap || newPersonal &gt; maxPerWallet) revert CapExceeded();\r\n        if (newPersonal &lt; minPerWallet) revert BelowMinimum();\r\n\r\n        \/\/ Every accepted contribution must be fully backed by tokens already held.\r\n        \/\/ Safe: newTotal &lt;= hardCap, and the constructor bounds rate * hardCap.\r\n        if (token.balanceOf(address(this)) &lt; newTotal * rate) revert SaleUnderfunded();\r\n\r\n        totalRaised = newTotal;\r\n        contributions[msg.sender] = newPersonal;\r\n        emit Contributed(msg.sender, msg.value);\r\n    }\r\n\r\n    \/\/\/ @notice Closes the sale. Only updates state; it moves no funds.\r\n    function finalize() external nonReentrant {\r\n        if (finalized) revert AlreadyFinalized();\r\n        if (block.timestamp &lt;= endTime &amp;&amp; totalRaised &lt; hardCap) revert SaleNotEnded();\r\n\r\n        finalized = true;\r\n        successful = totalRaised &gt;= softCap;\r\n        if (successful) {\r\n            tokensOutstanding = totalRaised * rate;\r\n        }\r\n        emit Finalized(successful, totalRaised);\r\n    }\r\n\r\n    \/\/\/ @notice Sends raised funds to the treasury after a successful sale. Callable by anyone.\r\n    function withdrawRaised() external nonReentrant {\r\n        if (!finalized || !successful || fundsWithdrawn) revert WithdrawUnavailable();\r\n\r\n        fundsWithdrawn = true;\r\n        uint256 amount = totalRaised;\r\n        (bool ok, ) = treasury.call{value: amount}(\"\");\r\n        if (!ok) revert TransferFailed();\r\n        emit Withdrawn(treasury, amount);\r\n    }\r\n\r\n    function claim() external nonReentrant {\r\n        if (!finalized || !successful) revert ClaimUnavailable();\r\n        uint256 paid = contributions[msg.sender];\r\n        if (paid == 0) revert NothingOwed();\r\n\r\n        contributions[msg.sender] = 0;\r\n        uint256 amount = paid * rate;\r\n        tokensOutstanding -= amount;\r\n        token.safeTransfer(msg.sender, amount);\r\n        emit Claimed(msg.sender, amount);\r\n    }\r\n\r\n    function refund() external nonReentrant {\r\n        if (!finalized || successful) revert RefundUnavailable();\r\n        uint256 paid = contributions[msg.sender];\r\n        if (paid == 0) revert NothingOwed();\r\n\r\n        contributions[msg.sender] = 0;\r\n        (bool ok, ) = payable(msg.sender).call{value: paid}(\"\");\r\n        if (!ok) revert TransferFailed();\r\n        emit Refunded(msg.sender, paid);\r\n    }\r\n\r\n    \/\/\/ @notice Sends tokens not owed to buyers to the treasury.\r\n    \/\/\/ @dev Successful sale: balance minus tokensOutstanding (which falls as buyers claim).\r\n    \/\/\/      Unsuccessful sale: the entire token balance.\r\n    function recoverExcessTokens() external nonReentrant {\r\n        if (!finalized) revert RecoverUnavailable();\r\n        uint256 bal = token.balanceOf(address(this));\r\n        uint256 reserved = successful ? tokensOutstanding : 0;\r\n        if (bal &lt;= reserved) revert NothingToRecover();\r\n\r\n        uint256 toSend = bal - reserved;\r\n        token.safeTransfer(treasury, toSend);\r\n        emit ExcessTokensRecovered(treasury, toSend);\r\n    }\r\n}<\/code><\/pre>\n<p><strong>Pricing limits.<\/strong><code style=\"background: #eef2f6; color: #0b1f3a; padding: 2px 6px; border-radius: 4px; font-size: 0.9em;\">rate<\/code> is an integer number of token base units per wei. With an 18-decimal token, <code style=\"background: #eef2f6; color: #0b1f3a; padding: 2px 6px; border-radius: 4px; font-size: 0.9em;\">rate = 1000<\/code> means 1,000 tokens per 1 ETH. Prices that need a fractional rate (for example 0.5 tokens per ETH) cannot be expressed. If you need finer pricing, add a rate denominator and apply it consistently in <code style=\"background: #eef2f6; color: #0b1f3a; padding: 2px 6px; border-radius: 4px; font-size: 0.9em;\">contribute()<\/code>, <code style=\"background: #eef2f6; color: #0b1f3a; padding: 2px 6px; border-radius: 4px; font-size: 0.9em;\">finalize()<\/code>, and <code style=\"background: #eef2f6; color: #0b1f3a; padding: 2px 6px; border-radius: 4px; font-size: 0.9em;\">claim()<\/code>.<\/p>\n<p><strong>Production scope.<\/strong> This code is educational and has not been audited. A production sale often also needs multi-asset contributions, multiple rounds, pause logic, a claim deadline before any broader residual sweep, and operational runbooks. Adapt, test, and audit before any real use.<\/p>\n<p><strong>Before the sale starts.<\/strong> Transfer at least <code style=\"background: #eef2f6; color: #0b1f3a; padding: 2px 6px; border-radius: 4px; font-size: 0.9em;\">hardCap * rate<\/code> token base units into the sale contract, and confirm the balance on a block explorer before the start time. Because <code style=\"background: #eef2f6; color: #0b1f3a; padding: 2px 6px; border-radius: 4px; font-size: 0.9em;\">contribute()<\/code> checks funding, contributions revert until the contract holds enough tokens, so a late or partial deposit cannot lock the sale into failure. Contributions beyond what the balance covers are rejected, so fund for the full hard cap.<\/p>\n<h3>Generating the whitelist root<\/h3>\n<p>Build the Merkle tree off-chain from KYC-approved addresses using <code style=\"background: #eef2f6; color: #0b1f3a; padding: 2px 6px; border-radius: 4px; font-size: 0.9em;\">@openzeppelin\/merkle-tree<\/code> with an <code style=\"background: #eef2f6; color: #0b1f3a; padding: 2px 6px; border-radius: 4px; font-size: 0.9em;\">[\"address\"]<\/code> leaf encoding:<\/p>\n<pre style=\"background: #0b1f3a; color: #e5e7eb; padding: 20px; border-radius: 10px; overflow-x: auto; font-size: 14px; line-height: 1.6; margin: 20px 0;\"><code>import { StandardMerkleTree } from \"@openzeppelin\/merkle-tree\";\r\n\r\nconst addresses = [\"0xabc...\", \"0xdef...\"]; \/\/ KYC-approved wallets\r\nconst tree = StandardMerkleTree.of(\r\n  addresses.map((a) =&gt; [a]),\r\n  [\"address\"]\r\n);\r\n\r\nconsole.log(tree.root); \/\/ pass into the sale constructor\r\n\/\/ For each investor: tree.getProof([investorAddress])<\/code><\/pre>\n<p>The root is immutable in this sample, so the whitelist is frozen at deployment. If you need to add investors later, an updatable root must sit behind a multi-signature wallet and a timelock, and that role must be disclosed. Serve each investor their proof through the sale dashboard. The on-chain leaf format matches the library&#8217;s double-hash convention.<\/p>\n<h2 id=\"stage-3\">Stage 3: Vesting Contracts<\/h2>\n<p>Vesting enforces the schedule from your tokenomics on-chain. OpenZeppelin&#8217;s <a href=\"https:\/\/docs.openzeppelin.com\/contracts\/5.x\/api\/finance\">VestingWallet<\/a> releases tokens linearly from a start time over a duration to a single beneficiary. <code style=\"background: #eef2f6; color: #0b1f3a; padding: 2px 6px; border-radius: 4px; font-size: 0.9em;\">VestingWalletCliff<\/code> (available since OpenZeppelin Contracts v5.1) adds a cliff. Confirm availability in the version you pin.<\/p>\n<p>Two properties matter for your disclosures. First, <code style=\"background: #eef2f6; color: #0b1f3a; padding: 2px 6px; border-radius: 4px; font-size: 0.9em;\">VestingWallet<\/code> is <strong>not revocable<\/strong>: once funded, the schedule cannot be cancelled or clawed back. Second, the wallet&#8217;s owner is the beneficiary, and ownership is transferable, so the beneficiary can hand the schedule to another address. If you need revocation, you must write custom vesting code, which adds a privileged role, a larger audit scope, and a trust question to disclose.<\/p>\n<h3>Design rules<\/h3>\n<ul style=\"font-size: 18px; line-height: 1.8; margin: 0 0 20px 0; padding-left: 24px;\">\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\">Deploy one vesting contract per beneficiary and publish every address. VestingWallet supports a single beneficiary, so a group schedule needs custom code or a multi-signature wallet as the beneficiary.<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\">Decide whether vesting is revocable. If it is, disclose who can revoke and why, and put that role under a multi-signature wallet.<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\">Fund each vesting contract directly from the treasury so the allocation is verifiable on a block explorer.<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\">Stagger cliffs across groups to avoid a single large unlock date.<\/li>\n<\/ul>\n<p>For allocation and unlock design, see our <a href=\"https:\/\/www.coindeveloperindia.com\/blog\/strengthen-your-ico-with-the-best-token-protocols\/\">ICO Tokenomics: Complete Guide<\/a>.<\/p>\n<h2 id=\"stage-4\">Stage 4: Access Control, Admin Functions, and Upgradeability<\/h2>\n<p><strong>Role minimization.<\/strong> Every privileged function (pause, parameter change, upgrade) is a trust assumption. Remove what you can and disclose what remains.<\/p>\n<p><strong>Multi-signature plus timelock.<\/strong> Place remaining admin roles under a multi-signature wallet and a timelock so investors can see a change before it takes effect.<\/p>\n<p><strong>Upgradeable or immutable?<\/strong> Proxy patterns (transparent or UUPS, following <a href=\"https:\/\/eips.ethereum.org\/EIPS\/eip-1967\">ERC-1967<\/a>) allow fixes after deployment but add storage-collision risk, an upgrade authority to protect, and an extra trust assumption. For sale and token contracts, immutable designs are simpler to audit and to trust. If you use proxies, protect the upgrade path with a timelock.<\/p>\n<p><strong>Compliance hooks.<\/strong> Smart contracts can enforce on-chain restrictions such as a whitelist, but they do not make a sale <a href=\"https:\/\/www.coindeveloperindia.com\/blog\/countries-for-legal-cryptocurrency\/\">legally compliant<\/a>. Security tokens use permissioned standards such as <a href=\"https:\/\/eips.ethereum.org\/EIPS\/eip-3643\">ERC-3643<\/a>, which build transfer restrictions into the token itself.<\/p>\n<h2 id=\"oracles\">Multi-Asset Sales and Price Oracles<\/h2>\n<p>If the sale accepts several assets (for example ETH and stablecoins), each contribution must be converted to a common value. Use a decentralized price feed such as Chainlink Data Feeds, reject stale, zero, or non-positive prices, and avoid pricing from a single DEX spot price, which can be manipulated.<\/p>\n<pre style=\"background: #0b1f3a; color: #e5e7eb; padding: 20px; border-radius: 10px; overflow-x: auto; font-size: 14px; line-height: 1.6; margin: 20px 0;\"><code>(, int256 answer, , uint256 updatedAt, ) = priceFeed.latestRoundData();\r\nrequire(\r\n    answer &gt; 0 &amp;&amp; updatedAt != 0 &amp;&amp; block.timestamp - updatedAt &lt;= MAX_STALENESS,\r\n    \"stale price\"\r\n);<\/code><\/pre>\n<p>On L2s such as Arbitrum, Optimism, and Base, also check the chain&#8217;s <a href=\"https:\/\/docs.chain.link\/data-feeds\/l2-sequencer-feeds\">sequencer uptime feed<\/a> before trusting a price, and allow a grace period after the sequencer restarts. Set <code style=\"background: #eef2f6; color: #0b1f3a; padding: 2px 6px; border-radius: 4px; font-size: 0.9em;\">MAX_STALENESS<\/code> per feed, based on its heartbeat.<\/p>\n<p>Accepting only a stablecoin removes the oracle dependency but narrows who can participate. Whichever assets you accept, review each token&#8217;s behavior before listing it:<\/p>\n<ul style=\"font-size: 18px; line-height: 1.8; margin: 0 0 20px 0; padding-left: 24px;\">\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\"><strong>Decimals differ.<\/strong> Many stablecoins use 6 decimals, so normalize amounts carefully.<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\"><strong>Non-standard returns.<\/strong> Some tokens (USDT is the well-known case) do not return a boolean from <code style=\"background: #eef2f6; color: #0b1f3a; padding: 2px 6px; border-radius: 4px; font-size: 0.9em;\">transfer<\/code>. <code style=\"background: #eef2f6; color: #0b1f3a; padding: 2px 6px; border-radius: 4px; font-size: 0.9em;\">SafeERC20<\/code> handles this.<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\"><strong>Fee-on-transfer and rebasing tokens.<\/strong> The amount received can differ from the amount sent. <code style=\"background: #eef2f6; color: #0b1f3a; padding: 2px 6px; border-radius: 4px; font-size: 0.9em;\">SafeERC20<\/code> does not fix this, so measure balances before and after, or do not accept these tokens.<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\"><strong>Blocklists and pausing.<\/strong> Some stablecoins can freeze addresses, which can block refunds. Disclose this risk.<\/li>\n<\/ul>\n<h2 id=\"solana\">Solana: Building a Token Sale Program<\/h2>\n<p>Solana uses a different model. An EVM contract cannot be recompiled for it.<\/p>\n<div class=\"custom-table-wrapper\" style=\"overflow-x: auto; margin: 20px 0;\">\n<table class=\"custom-comparison-table\" style=\"width: 100%; margin-top: 0; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 15px;\">\n<thead>\n<tr style=\"background: linear-gradient(90deg,#0f766e,#0e7490); color: #fff;\">\n<th style=\"padding: 14px; border: 1px solid #ddd; text-align: left;\">Topic<\/th>\n<th style=\"padding: 14px; border: 1px solid #ddd; text-align: left;\">EVM<\/th>\n<th style=\"padding: 14px; border: 1px solid #ddd; text-align: left;\">Solana<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr style=\"background: #fff;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Language<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Solidity<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Rust<\/td>\n<\/tr>\n<tr style=\"background: #f3faf9;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Token creation<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Deploy an ERC-20 contract<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Create a mint with the SPL Token or Token-2022 program<\/td>\n<\/tr>\n<tr style=\"background: #fff;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Sale logic<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">One contract holds state<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">A program plus separate accounts holding state<\/td>\n<\/tr>\n<tr style=\"background: #f3faf9;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Framework<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Foundry, Hardhat<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Anchor<\/td>\n<\/tr>\n<tr style=\"background: #fff;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Funds custody<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Contract balance<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Escrow accounts controlled by program-derived addresses (PDAs)<\/td>\n<\/tr>\n<tr style=\"background: #f3faf9;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Post-deployment changes<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Immutable unless built with a proxy<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Programs are upgradeable by default; the upgrade authority can replace the code<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<h3>What changes in practice<\/h3>\n<ul style=\"font-size: 18px; line-height: 1.8; margin: 0 0 20px 0; padding-left: 24px;\">\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\"><strong>Accounts, not global storage.<\/strong> Sale state lives in accounts the client passes into each instruction. Validate owner, mint, PDA seeds, and signers on every instruction. Missing checks are a common Solana vulnerability class.<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\"><strong>PDAs for escrow.<\/strong> Raise funds into an escrow account owned by a PDA derived from fixed seeds (for example <code style=\"background: #eef2f6; color: #0b1f3a; padding: 2px 6px; border-radius: 4px; font-size: 0.9em;\">[\"sale\", sale_id]<\/code>). Only the program should move those funds when sale rules allow.<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\"><strong>Program upgrade authority.<\/strong> Programs deploy as upgradeable by default, so whoever holds the upgrade authority can replace the sale logic, including logic that controls escrowed funds. This is one of the most important trust points. Revoke the upgrade authority once the program is final, or place it under a multi-signature (for example <a href=\"https:\/\/squads.so\">Squads<\/a>) with a timelock, and disclose which you chose.<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\"><strong>Mint and freeze authority.<\/strong> Decide who holds mint authority (and freeze authority, if enabled), disclose it, and revoke it or place it under a multi-signature once supply is final.<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\"><strong>Token-2022.<\/strong> Extensions such as transfer fees and transfer hooks change product behavior. Choose standard SPL Token versus Token-2022 early so auditors know the exact program surface.<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\"><strong>Typical Anchor flow.<\/strong> Instructions often include <code style=\"background: #eef2f6; color: #0b1f3a; padding: 2px 6px; border-radius: 4px; font-size: 0.9em;\">initialize_sale<\/code> (config plus escrow PDA), <code style=\"background: #eef2f6; color: #0b1f3a; padding: 2px 6px; border-radius: 4px; font-size: 0.9em;\">contribute<\/code>, <code style=\"background: #eef2f6; color: #0b1f3a; padding: 2px 6px; border-radius: 4px; font-size: 0.9em;\">finalize<\/code>, and <code style=\"background: #eef2f6; color: #0b1f3a; padding: 2px 6px; border-radius: 4px; font-size: 0.9em;\">claim<\/code> or <code style=\"background: #eef2f6; color: #0b1f3a; padding: 2px 6px; border-radius: 4px; font-size: 0.9em;\">refund<\/code>. Each instruction&#8217;s accounts struct must constrain every account.<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\"><strong>Audits.<\/strong> Use firms with Solana-specific experience. EVM audit skills do not transfer directly to account validation, cross-program invocations (CPI), and PDA patterns.<\/li>\n<\/ul>\n<p>A Solana token sale program is a separate codebase and a separate audit scope from your EVM contracts.<\/p>\n<h2 id=\"security\">Security: Vulnerabilities and Mitigations<\/h2>\n<div class=\"custom-table-wrapper\" style=\"overflow-x: auto; margin: 20px 0;\">\n<table class=\"custom-comparison-table\" style=\"width: 100%; margin-top: 0; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 15px;\">\n<thead>\n<tr style=\"background: linear-gradient(90deg,#0f766e,#0e7490); color: #fff;\">\n<th style=\"padding: 14px; border: 1px solid #ddd; text-align: left;\">Risk<\/th>\n<th style=\"padding: 14px; border: 1px solid #ddd; text-align: left;\">What happens<\/th>\n<th style=\"padding: 14px; border: 1px solid #ddd; text-align: left;\">Mitigation<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr style=\"background: #fff;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Reentrancy<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">An external call re-enters before state updates<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Checks-effects-interactions, ReentrancyGuard, pull payments<\/td>\n<\/tr>\n<tr style=\"background: #f3faf9;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Access-control flaws<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Unprotected sensitive functions<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Role-based access, least privilege, tests per function<\/td>\n<\/tr>\n<tr style=\"background: #fff;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Oracle manipulation<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Attacker moves the price source<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Decentralized feeds, staleness and sanity checks, L2 sequencer checks<\/td>\n<\/tr>\n<tr style=\"background: #f3faf9;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Front-running<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Transactions are observed and reordered<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Caps and limits, commit-reveal where relevant<\/td>\n<\/tr>\n<tr style=\"background: #fff;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Unsafe external calls<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Unchecked returns, malicious or non-standard tokens<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">SafeERC20, check call results, restrict token addresses, avoid fee-on-transfer tokens<\/td>\n<\/tr>\n<tr style=\"background: #f3faf9;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Arithmetic edge cases<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Overflow in pricing math, rounding and precision loss<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Checked arithmetic; bound <code style=\"background: #eef2f6; color: #0b1f3a; padding: 2px 6px; border-radius: 4px; font-size: 0.9em;\">rate * hardCap<\/code> in the constructor; test rounding at the boundaries<\/td>\n<\/tr>\n<tr style=\"background: #fff;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Signature replay<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">A signed permit or message is reused<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Nonces, deadlines, and domain separation (EIP-712)<\/td>\n<\/tr>\n<tr style=\"background: #f3faf9;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Denial of service<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Unbounded loops, blocked refunds, reverting fund transfers<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Pull-based claims, withdrawals, and refunds; no unbounded loops<\/td>\n<\/tr>\n<tr style=\"background: #fff;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Centralization risk<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">One key controls funds or supply<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Multi-signature, timelock, minimal roles<\/td>\n<\/tr>\n<tr style=\"background: #f3faf9;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Upgrade risk<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Storage collisions or a compromised upgrade key<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Prefer immutable contracts, or timelock the upgrade path<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<h2 id=\"testing\">Testing: What to Cover Before the Audit<\/h2>\n<div class=\"custom-table-wrapper\" style=\"overflow-x: auto; margin: 20px 0;\">\n<table class=\"custom-comparison-table\" style=\"width: 100%; margin-top: 0; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 15px;\">\n<thead>\n<tr style=\"background: linear-gradient(90deg,#0f766e,#0e7490); color: #fff;\">\n<th style=\"padding: 14px; border: 1px solid #ddd; text-align: left;\">Scenario<\/th>\n<th style=\"padding: 14px; border: 1px solid #ddd; text-align: left;\">What to verify<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr style=\"background: #fff;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Happy path<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Whitelisted buyer contributes, sale finalizes, buyer claims the correct amount<\/td>\n<\/tr>\n<tr style=\"background: #f3faf9;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Caps<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Hard cap and per-wallet min\/max enforced at the boundaries<\/td>\n<\/tr>\n<tr style=\"background: #fff;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Soft cap missed<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Sale finalizes as unsuccessful; every contributor can refund in full<\/td>\n<\/tr>\n<tr style=\"background: #f3faf9;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Underfunded sale<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Contributions that the token balance cannot cover revert; a late deposit lets contributions resume<\/td>\n<\/tr>\n<tr style=\"background: #fff;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Whitelist<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Invalid proofs, wrong addresses, and malformed proofs revert<\/td>\n<\/tr>\n<tr style=\"background: #f3faf9;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Time window<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Contributions before start or after end revert<\/td>\n<\/tr>\n<tr style=\"background: #fff;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Double actions<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Claim twice, refund twice, finalize twice, and withdraw twice all revert<\/td>\n<\/tr>\n<tr style=\"background: #f3faf9;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Treasury withdrawal<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><code style=\"background: #eef2f6; color: #0b1f3a; padding: 2px 6px; border-radius: 4px; font-size: 0.9em;\">finalize()<\/code> moves no ETH; <code style=\"background: #eef2f6; color: #0b1f3a; padding: 2px 6px; border-radius: 4px; font-size: 0.9em;\">withdrawRaised()<\/code> sends exactly <code style=\"background: #eef2f6; color: #0b1f3a; padding: 2px 6px; border-radius: 4px; font-size: 0.9em;\">totalRaised<\/code> once; a reverting treasury blocks only the withdrawal, not claims<\/td>\n<\/tr>\n<tr style=\"background: #fff;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Excess recovery<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Successful sale recovers <code style=\"background: #eef2f6; color: #0b1f3a; padding: 2px 6px; border-radius: 4px; font-size: 0.9em;\">balance - tokensOutstanding<\/code>, and still works after every buyer has claimed; unsuccessful sale recovers the full token balance<\/td>\n<\/tr>\n<tr style=\"background: #f3faf9;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Constructor bounds<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Zero hard cap, zero rate, and <code style=\"background: #eef2f6; color: #0b1f3a; padding: 2px 6px; border-radius: 4px; font-size: 0.9em;\">rate * hardCap<\/code> overflow all revert<\/td>\n<\/tr>\n<tr style=\"background: #fff;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Reentrancy<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">A malicious receiver cannot drain funds<\/td>\n<\/tr>\n<tr style=\"background: #f3faf9;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Fuzzing<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Random amounts and callers cannot break accounting invariants<\/td>\n<\/tr>\n<tr style=\"background: #fff;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Invariants<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Current contributions plus contributions already settled by claim or refund equal totalRaised; after a successful finalize, tokensOutstanding equals unclaimed contributions times rate; the token balance is never below tokensOutstanding<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<pre style=\"background: #0b1f3a; color: #e5e7eb; padding: 20px; border-radius: 10px; overflow-x: auto; font-size: 14px; line-height: 1.6; margin: 20px 0;\"><code>forge build\r\nforge test -vvv\r\nforge coverage\r\nslither .<\/code><\/pre>\n<p>For the highest-value logic, such as accounting and pricing math, consider formal verification with tools like Certora or Halmos in addition to fuzzing.<\/p>\n<p>Rehearse the full <a href=\"https:\/\/www.coindeveloperindia.com\/blog\/how-to-launch-a-successful-ico\/\">ICO launch<\/a> on a public testnet before mainnet: same scripts, same multi-signature setup, and end-to-end paths for contribution, hard-cap reached, refund, claim, treasury withdrawal, excess recovery, and vesting release.<\/p>\n<h2 id=\"audit\">The Audit Process<\/h2>\n<ul style=\"font-size: 18px; line-height: 1.8; margin: 0 0 20px 0; padding-left: 24px;\">\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\"><strong>Prepare an audit-ready package:<\/strong> frozen code, specifications, test suite, deployment scripts, and documentation.<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\"><strong>Independent review:<\/strong> manual review plus automated analysis by experienced security engineers.<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\"><strong>Findings report:<\/strong> issues classified by severity (critical, high, medium, low, informational).<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\"><strong>Remediation:<\/strong> fix every finding in code, not only in documentation.<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\"><strong>Re-audit:<\/strong> every material change after the audit needs review.<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\"><strong>Publish the report<\/strong> so investors can verify it.<\/li>\n<\/ul>\n<p>Never deploy unaudited contracts that will hold investor funds. An audit reduces risk; it does not eliminate it. Audits have scope limits and cannot guarantee the absence of bugs, so consider a bug bounty and an incident-response plan before launch.<\/p>\n<h2 id=\"deployment\">Deployment and Verification<\/h2>\n<ul style=\"font-size: 18px; line-height: 1.8; margin: 0 0 20px 0; padding-left: 24px;\">\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\">Pin dependency and compiler versions, and record them in the repository.<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\">Match the EVM target to the chain before deploying. The default target depends on the compiler: Solidity 0.8.24 defaults to Shanghai, 0.8.25 and later default to Cancun, and 0.8.30 and later default to Prague. For chains that have not activated Cancun, set an older target in foundry.toml, for example <code style=\"background: #eef2f6; color: #0b1f3a; padding: 2px 6px; border-radius: 4px; font-size: 0.9em;\">evm_version = \"paris\"<\/code> (or <code style=\"background: #eef2f6; color: #0b1f3a; padding: 2px 6px; border-radius: 4px; font-size: 0.9em;\">\"shanghai\"<\/code> if the chain supports PUSH0), and confirm with a testnet deployment.<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\">Deploy with scripts, not by hand. Example:\n<pre style=\"background: #0b1f3a; color: #e5e7eb; padding: 20px; border-radius: 10px; overflow-x: auto; font-size: 14px; line-height: 1.6; margin: 12px 0 0 0;\"><code>forge script script\/Deploy.s.sol --rpc-url $RPC_URL --broadcast --verify<\/code><\/pre>\n<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\">Verify source code on the block explorer.<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\">Confirm the treasury address, send it a small test transfer, and test a multi-signature signing round.<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\">Transfer any admin roles to the multi-signature wallet.<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\">Fund the sale contract with the planned token allocation (<code style=\"background: #eef2f6; color: #0b1f3a; padding: 2px 6px; border-radius: 4px; font-size: 0.9em;\">hardCap * rate<\/code> base units) and confirm balances on-chain before the start time.<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\">Publish all contract addresses with the audit report.<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\">Monitor contribution, finalization, withdrawal, claim, refund, and recovery events during and after the sale.<\/li>\n<\/ul>\n<h2 id=\"cost\">Cost and Timeline Factors<\/h2>\n<p>Cost varies with scope. Treat flat quotes that ignore complexity with caution. The ranges below are indicative engineering estimates commonly seen in the market. <strong>They cover development and testing only. Independent audit fees, <a href=\"https:\/\/www.coindeveloperindia.com\/blog\/why-is-it-important-to-have-a-strategic-approach-to-ico-marketing\/\">ICO marketing<\/a>, and legal costs are separate.<\/strong> Depending on code size, chain, and the firm, an audit can cost as much as or more than development, so budget for it from the start and compare quotes on a like-for-like basis.<\/p>\n<div class=\"custom-table-wrapper\" style=\"overflow-x: auto; margin: 20px 0;\">\n<table class=\"custom-comparison-table\" style=\"width: 100%; margin-top: 0; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 15px;\">\n<thead>\n<tr style=\"background: linear-gradient(90deg,#0f766e,#0e7490); color: #fff;\">\n<th style=\"padding: 14px; border: 1px solid #ddd; text-align: left;\">Scope<\/th>\n<th style=\"padding: 14px; border: 1px solid #ddd; text-align: left;\">Indicative range (development only)<\/th>\n<th style=\"padding: 14px; border: 1px solid #ddd; text-align: left;\">Typical duration<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr style=\"background: #fff;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Token + basic sale (caps, whitelist, refunds)<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Low-to-mid four figures USD<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">About 2\u20134 weeks<\/td>\n<\/tr>\n<tr style=\"background: #f3faf9;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Sale + vesting + test suite + testnet<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Mid four figures USD<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">About 3\u20136 weeks<\/td>\n<\/tr>\n<tr style=\"background: #fff;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Multi-round \/ multi-asset \/ oracle + audit coordination<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Higher four to five figures USD<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Several weeks, plus the audit queue<\/td>\n<\/tr>\n<tr style=\"background: #f3faf9;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Solana program in addition to EVM<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Separate language and audit scope<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Parallel or sequential track<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<div class=\"custom-table-wrapper\" style=\"overflow-x: auto; margin: 20px 0;\">\n<table class=\"custom-comparison-table\" style=\"width: 100%; margin-top: 0; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 15px;\">\n<thead>\n<tr style=\"background: linear-gradient(90deg,#0f766e,#0e7490); color: #fff;\">\n<th style=\"padding: 14px; border: 1px solid #ddd; text-align: left;\">Driver<\/th>\n<th style=\"padding: 14px; border: 1px solid #ddd; text-align: left;\">Why it matters<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr style=\"background: #fff;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Number and complexity of contracts<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Token, sale, vesting, and related modules each add scope<\/td>\n<\/tr>\n<tr style=\"background: #f3faf9;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Blockchain<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">EVM and Solana need different languages, tooling, and auditors<\/td>\n<\/tr>\n<tr style=\"background: #fff;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Sale mechanics<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Multi-round pricing, multi-asset contributions, and oracles add risk and test effort<\/td>\n<\/tr>\n<tr style=\"background: #f3faf9;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Test depth<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Fuzzing and invariant tests take time but catch high-impact bugs<\/td>\n<\/tr>\n<tr style=\"background: #fff;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Audit scope<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Code size and number of rounds drive cost and calendar time<\/td>\n<\/tr>\n<tr style=\"background: #f3faf9;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Documentation and handover<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Specifications, scripts, and runbooks<\/td>\n<\/tr>\n<tr style=\"background: #fff;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Post-launch support<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Monitoring, vesting administration, incident response<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<p>Audit availability is a frequent source of schedule slip, so book it early. Request an itemized proposal that separates development, testing, audit coordination, and support, and states clearly whether audit fees are included.<\/p>\n<h2 id=\"partner\">What to Expect From an ICO Smart Contract Development Partner<\/h2>\n<div class=\"custom-table-wrapper\" style=\"overflow-x: auto; margin: 20px 0;\">\n<table class=\"custom-comparison-table\" style=\"width: 100%; margin-top: 0; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 15px;\">\n<thead>\n<tr style=\"background: linear-gradient(90deg,#0f766e,#0e7490); color: #fff;\">\n<th style=\"padding: 14px; border: 1px solid #ddd; text-align: left;\">Deliverable<\/th>\n<th style=\"padding: 14px; border: 1px solid #ddd; text-align: left;\">Why it matters<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr style=\"background: #fff;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Specification document<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Defines intended behavior before code is written<\/td>\n<\/tr>\n<tr style=\"background: #f3faf9;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Source code with clear license and ownership<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">You should own the code you pay for<\/td>\n<\/tr>\n<tr style=\"background: #fff;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Test suite and coverage report<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Evidence of failure-path testing<\/td>\n<\/tr>\n<tr style=\"background: #f3faf9;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Deployment scripts<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Repeatable, reviewable mainnet deployment<\/td>\n<\/tr>\n<tr style=\"background: #fff;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Audit coordination<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Preparation, remediation, and re-audit support<\/td>\n<\/tr>\n<tr style=\"background: #f3faf9;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Verified contracts<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Source published on the block explorer<\/td>\n<\/tr>\n<tr style=\"background: #fff;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\"><strong>Handover documentation<\/strong><\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd; vertical-align: top;\">Roles, addresses, multi-signature setup, emergency procedures<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<p>Ask for verifiable past work: deployed, verified contracts you can inspect yourself.<\/p>\n<h2 id=\"checklist\">Pre-Audit Checklist<\/h2>\n<ul style=\"font-size: 18px; line-height: 1.8; margin: 0 0 20px 0; padding-left: 24px;\">\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\">Specification written and matched to the code<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\">Privileged roles minimized, documented, and disclosed<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\">Treasury and admin roles under a multi-signature wallet, with a timelock on admin actions<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\">Treasury address confirmed on-chain and able to receive funds<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\">Pull-based claims, refunds, and withdrawals; no unbounded loops<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\">Reentrancy protection on every external-call path<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\">Soft-cap-missed and underfunded paths tested<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\"><code style=\"background: #eef2f6; color: #0b1f3a; padding: 2px 6px; border-radius: 4px; font-size: 0.9em;\">rate * hardCap<\/code> overflow bound (or equivalent safe math) in place, with a non-zero hard cap<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\">Token accounting tracks outstanding obligations; excess and unsold token recovery tested after claims<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\">Oracle staleness, zero-value, and sanity checks in place, plus L2 sequencer checks (if used)<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\">Unit, integration, fuzz, and invariant tests passing; coverage reviewed<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\">Static analysis findings reviewed and resolved<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\">Full sale rehearsal completed on a public testnet<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\">Dependency and compiler versions pinned; EVM target matched to the chain<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\">Deployment scripts reviewed; verified-source plan ready<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\">Solana only: program upgrade authority and mint authority decisions documented<\/li>\n<\/ul>\n<p>Download the ICO Smart Contract Pre-Audit Checklist as a printable PDF.<\/p>\n<h2 id=\"mistakes\">Common ICO Smart Contract Mistakes<\/h2>\n<ul style=\"font-size: 18px; line-height: 1.8; margin: 0 0 20px 0; padding-left: 24px;\">\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\">Launching unaudited contracts that hold investor funds<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\">Keeping an owner key that can mint, pause, or withdraw without disclosure<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\">Pushing refunds or tokens to many addresses in one loop<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\">Tying a fund transfer to a state change, so one failing recipient can freeze the whole sale<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\">Testing only the happy path<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\">Treating the whitelist as legal compliance rather than an enforcement mechanism<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\">Using a single DEX spot price as an oracle<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\">Deploying from a personal wallet and never moving admin rights to a multi-signature wallet<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\">Making changes after the audit without a re-audit<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\">Leaving no path to recover unsold or excess tokens after finalization<\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\">Leaving a Solana program&#8217;s upgrade authority with a single key<\/li>\n<\/ul>\n<div style=\"background: #f7f9fa; border: 1px solid #e3e8ec; border-radius: 18px; padding: 25px 30px; margin: 40px 0;\">\n<p style=\"margin-top: 0; margin-bottom: 18px; color: #b45309; font-size: 22px; font-weight: bold;\">Also Read<\/p>\n<ul style=\"font-size: 18px; line-height: 1.8; margin: 0 0 20px 0; padding-left: 24px;\">\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\"><a href=\"https:\/\/www.coindeveloperindia.com\/blog\/ico-development-process\/\">ICO Development Process: From Idea to Token Sale<\/a><\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\"><a href=\"https:\/\/www.coindeveloperindia.com\/blog\/how-to-launch-a-successful-ico\/\">How to Launch a Successful ICO<\/a><\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\"><a href=\"https:\/\/www.coindeveloperindia.com\/blog\/initial-dex-offering-ido-development\/\">Initial DEX Offering (IDO) Development Guide<\/a><\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\"><a href=\"https:\/\/www.coindeveloperindia.com\/blog\/ico-vs-ipo\/\">ICO vs IPO: Key Differences for Startups and Investors<\/a><\/li>\n<\/ul>\n<\/div>\n<h2 id=\"faq\">Frequently Asked Questions<\/h2>\n<h3>What is an ICO smart contract?<\/h3>\n<p>An ICO smart contract is the on-chain program that governs a token sale. It accepts contributions, enforces rules such as caps and whitelists, and distributes tokens or refunds according to the outcome. A full system also includes the token, vesting, and treasury components.<\/p>\n<h3>Which language is used for ICO smart contracts?<\/h3>\n<p>Solidity is standard on EVM chains such as Ethereum, BNB Chain, Polygon, Arbitrum, Optimism, and Base. Solana programs are written in Rust, usually with the Anchor framework.<\/p>\n<h3>How do I restrict an ICO to KYC-verified investors?<\/h3>\n<p>KYC is performed off-chain by a verification provider. Approved wallet addresses are encoded into an on-chain whitelist, commonly a Merkle tree whose root is stored in the contract. Each approved investor submits a proof when contributing.<\/p>\n<h3>What is the difference between a token contract and a sale contract?<\/h3>\n<p>The token contract defines the asset: supply, transfers, and burning. The sale contract defines how investors acquire it: pricing, caps, timing, whitelist, and refunds. Keeping them separate reduces risk and simplifies audits.<\/p>\n<h3>Should ICO smart contracts be upgradeable?<\/h3>\n<p>Immutable contracts are simpler to audit and to trust, so they are often preferred for sale and token contracts. Upgradeable proxies allow later fixes but add storage-collision risk and an upgrade authority that must be protected, ideally with a multi-signature wallet and a timelock. On Solana, programs are upgradeable by default, so decide whether to revoke or secure the upgrade authority.<\/p>\n<h3>Is a smart contract audit required for an ICO?<\/h3>\n<p>It is not a universal legal requirement, but it is an essential trust and risk-control measure. Investors, <a href=\"https:\/\/www.coindeveloperindia.com\/blog\/initial-dex-offering-ido-development\/\">launchpads<\/a>, and exchanges commonly expect an independent audit report. An audit reduces risk but does not guarantee that a contract is free of flaws.<\/p>\n<h3>What are the most common ICO smart contract vulnerabilities?<\/h3>\n<p>Reentrancy, access-control flaws, oracle manipulation, unsafe external calls, arithmetic and rounding edge cases, denial of service through unbounded loops or failing transfers, and over-centralized admin keys. Testing, minimal privileges, and independent audits mitigate them.<\/p>\n<h3>How long does ICO smart contract development take?<\/h3>\n<p>Several weeks for development, plus an audit window of additional weeks. Scope, chain, and audit availability drive the schedule.<\/p>\n<h3>How much does ICO smart contract development cost?<\/h3>\n<p>It depends on contract count, sale mechanics, chain, test depth, and audit scope. Basic token-plus-sale development often sits in the low-to-mid four figures USD; multi-asset, multi-round, or dual-chain (EVM + Solana) work costs more. Independent audit fees are separate and can be significant. Request an itemized proposal.<\/p>\n<h3>Do smart contracts make an ICO legally compliant?<\/h3>\n<p>No. Contracts can enforce rules such as whitelists and caps, but legal classification, KYC\/AML obligations, disclosures, and tax treatment depend on the <a href=\"https:\/\/www.coindeveloperindia.com\/blog\/countries-for-legal-cryptocurrency\/\">jurisdiction<\/a> and need qualified legal counsel. Depending on where you sell and who can buy, relevant regimes can include U.S. securities law, the EU&#8217;s Markets in Crypto-Assets Regulation (MiCA), and, in India, the tax and reporting rules for virtual digital assets. Rules change often, so confirm current requirements with counsel. See our ICO Development Process: From Idea to Token Sale guide for the regulatory stage.<\/p>\n<h2 id=\"build\">Build ICO Smart Contracts You Can Defend<\/h2>\n<p>A token sale is only as trustworthy as the code that runs it. At Coin Developer India, we help projects design, build, test, and prepare contracts for audit and deployment.<\/p>\n<div style=\"background: #0b1f3a; color: #fff; padding: 28px 30px; border-left: 6px solid #f59e0b; border-radius: 10px; margin: 35px 0;\">\n<p style=\"margin: 0;\"><a style=\"display: inline-block; background: #fff; color: #0b1f3a; padding: 12px 26px; border-radius: 6px; font-weight: bold; text-decoration: none; margin: 0 10px 10px 0;\" href=\"https:\/\/www.coindeveloperindia.com\/contact-us\">Request a Free Technical Consultation<\/a><\/p>\n<\/div>\n<p>Related: <a href=\"https:\/\/www.coindeveloperindia.com\/smart-contract-development\">Smart contract development<\/a> \u00b7 <a href=\"https:\/\/www.coindeveloperindia.com\/ico-development\">ICO development company in India<\/a> \u00b7 <a href=\"https:\/\/www.coindeveloperindia.com\/blog\/ico-development-process\/\">ICO Token Development: Complete Guide<\/a><\/p>\n<h2 id=\"sources\">Sources and Further Reading<\/h2>\n<ul style=\"font-size: 18px; line-height: 1.8; margin: 0 0 20px 0; padding-left: 24px;\">\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\"><a href=\"https:\/\/docs.openzeppelin.com\/contracts\">OpenZeppelin Contracts documentation<\/a><\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\"><a href=\"https:\/\/github.com\/OpenZeppelin\/merkle-tree\">OpenZeppelin Merkle Tree library<\/a><\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\"><a href=\"https:\/\/eips.ethereum.org\/EIPS\/eip-2612\">EIP-2612: Permit<\/a><\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\"><a href=\"https:\/\/eips.ethereum.org\/EIPS\/eip-1967\">ERC-1967: Proxy storage slots<\/a><\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\"><a href=\"https:\/\/eips.ethereum.org\/EIPS\/eip-3643\">ERC-3643: Permissioned tokens<\/a><\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\"><a href=\"https:\/\/docs.chain.link\/data-feeds\">Chainlink Data Feeds<\/a> and <a href=\"https:\/\/docs.chain.link\/data-feeds\/l2-sequencer-feeds\">L2 sequencer uptime feeds<\/a><\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\"><a href=\"https:\/\/book.getfoundry.sh\">Foundry Book<\/a><\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\"><a href=\"https:\/\/www.anchor-lang.com\/docs\">Anchor documentation<\/a><\/li>\n<li style=\"font-size: 18px; line-height: 1.8; margin-bottom: 8px;\"><a href=\"https:\/\/squads.so\">Squads<\/a><\/li>\n<\/ul>\n<p style=\"font-size: 14px; color: #666; margin-top: 10px;\">This article is for informational purposes only and is not legal, tax, or investment advice. Code examples are educational and unaudited. Obtain independent security review before deploying contracts that hold value.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>In a token sale, the smart contract is the core of the business. It holds investor funds, enforces the rules, and cannot be recalled once deployed. A flaw is not a bug report. It is a permanent, public, financial event. This guide covers ICO smart contract development end to end: architecture, token and sale contract&hellip;<\/p>\n","protected":false},"author":5,"featured_media":5569,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":["post-5568","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ico-development-services"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v20.3 (Yoast SEO v26.9) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>ICO Smart Contract Development: Complete Technical Guide<\/title>\n<meta name=\"description\" content=\"Learn ICO smart contract development: architecture, token and sale contracts, vesting, security, testing, audits and deployment, with code examples.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.coindeveloperindia.com\/blog\/ico-smart-contract-development-guide\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"ICO Smart Contract Development: Complete Technical Guide\" \/>\n<meta property=\"og:description\" content=\"Learn ICO smart contract development: architecture, token and sale contracts, vesting, security, testing, audits and deployment, with code examples.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.coindeveloperindia.com\/blog\/ico-smart-contract-development-guide\/\" \/>\n<meta property=\"og:site_name\" content=\"Coin Developer India Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/facebook.com\/CoinDeveloperIN\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-22T13:08:28+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-22T13:55:03+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.coindeveloperindia.com\/blog\/wp-content\/uploads\/2026\/10\/coindeveloperindia-blog-8.png\" \/>\n\t<meta property=\"og:image:width\" content=\"800\" \/>\n\t<meta property=\"og:image:height\" content=\"450\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Shalu Swami\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:title\" content=\"ICO Smart Contract Development: Complete Technical Guide\" \/>\n<meta name=\"twitter:description\" content=\"Learn ICO smart contract development: architecture, token and sale contracts, vesting, security, testing, audits and deployment, with code examples.\" \/>\n<meta name=\"twitter:creator\" content=\"@CoinDeveloperIN\" \/>\n<meta name=\"twitter:site\" content=\"@CoinDeveloperIN\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Shalu Swami\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"25 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.coindeveloperindia.com\/blog\/ico-smart-contract-development-guide\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.coindeveloperindia.com\/blog\/ico-smart-contract-development-guide\/\"},\"author\":{\"name\":\"Shalu Swami\",\"@id\":\"https:\/\/www.coindeveloperindia.com\/blog\/#\/schema\/person\/9c956fd77b089f30c50893e835725532\"},\"headline\":\"ICO Smart Contract Development: Complete Technical Guide\",\"datePublished\":\"2026-10-22T13:08:28+00:00\",\"dateModified\":\"2026-10-22T13:55:03+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.coindeveloperindia.com\/blog\/ico-smart-contract-development-guide\/\"},\"wordCount\":4068,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.coindeveloperindia.com\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.coindeveloperindia.com\/blog\/ico-smart-contract-development-guide\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.coindeveloperindia.com\/blog\/wp-content\/uploads\/2026\/10\/coindeveloperindia-blog-8.png\",\"articleSection\":[\"ICO development services\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.coindeveloperindia.com\/blog\/ico-smart-contract-development-guide\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.coindeveloperindia.com\/blog\/ico-smart-contract-development-guide\/\",\"url\":\"https:\/\/www.coindeveloperindia.com\/blog\/ico-smart-contract-development-guide\/\",\"name\":\"ICO Smart Contract Development: Complete Technical Guide\",\"isPartOf\":{\"@id\":\"https:\/\/www.coindeveloperindia.com\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.coindeveloperindia.com\/blog\/ico-smart-contract-development-guide\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.coindeveloperindia.com\/blog\/ico-smart-contract-development-guide\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.coindeveloperindia.com\/blog\/wp-content\/uploads\/2026\/10\/coindeveloperindia-blog-8.png\",\"datePublished\":\"2026-10-22T13:08:28+00:00\",\"dateModified\":\"2026-10-22T13:55:03+00:00\",\"description\":\"Learn ICO smart contract development: architecture, token and sale contracts, vesting, security, testing, audits and deployment, with code examples.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.coindeveloperindia.com\/blog\/ico-smart-contract-development-guide\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.coindeveloperindia.com\/blog\/ico-smart-contract-development-guide\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.coindeveloperindia.com\/blog\/ico-smart-contract-development-guide\/#primaryimage\",\"url\":\"https:\/\/www.coindeveloperindia.com\/blog\/wp-content\/uploads\/2026\/10\/coindeveloperindia-blog-8.png\",\"contentUrl\":\"https:\/\/www.coindeveloperindia.com\/blog\/wp-content\/uploads\/2026\/10\/coindeveloperindia-blog-8.png\",\"width\":800,\"height\":450,\"caption\":\"ICO smart contract development complete technical guide with Solidity code and security shield\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.coindeveloperindia.com\/blog\/ico-smart-contract-development-guide\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.coindeveloperindia.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"ICO Smart Contract Development: Complete Technical Guide\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.coindeveloperindia.com\/blog\/#website\",\"url\":\"https:\/\/www.coindeveloperindia.com\/blog\/\",\"name\":\"Coin Developer India Blog\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/www.coindeveloperindia.com\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.coindeveloperindia.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.coindeveloperindia.com\/blog\/#organization\",\"name\":\"Coin Developer India\",\"url\":\"https:\/\/www.coindeveloperindia.com\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.coindeveloperindia.com\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.coindeveloperindia.com\/blog\/wp-content\/uploads\/2025\/02\/cropped-logo.png\",\"contentUrl\":\"https:\/\/www.coindeveloperindia.com\/blog\/wp-content\/uploads\/2025\/02\/cropped-logo.png\",\"width\":258,\"height\":50,\"caption\":\"Coin Developer India\"},\"image\":{\"@id\":\"https:\/\/www.coindeveloperindia.com\/blog\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/facebook.com\/CoinDeveloperIN\",\"https:\/\/x.com\/CoinDeveloperIN\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.coindeveloperindia.com\/blog\/#\/schema\/person\/9c956fd77b089f30c50893e835725532\",\"name\":\"Shalu Swami\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.coindeveloperindia.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/www.coindeveloperindia.com\/blog\/wp-content\/uploads\/2026\/09\/shalu-swami-150x150.webp\",\"contentUrl\":\"https:\/\/www.coindeveloperindia.com\/blog\/wp-content\/uploads\/2026\/09\/shalu-swami-150x150.webp\",\"caption\":\"Shalu Swami\"},\"description\":\"Shalu Swami is the Director of Coin Developer India, specializing in blockchain and cryptocurrency development. Her expertise includes smart contracts, crypto exchanges, token development, DeFi, Web3, and Real-World Asset (RWA) tokenization. She reviews and contributes to Coin Developer India\u2019s technical content, focusing on accurate, practical, and industry-relevant blockchain insights.\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"ICO Smart Contract Development: Complete Technical Guide","description":"Learn ICO smart contract development: architecture, token and sale contracts, vesting, security, testing, audits and deployment, with code examples.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.coindeveloperindia.com\/blog\/ico-smart-contract-development-guide\/","og_locale":"en_US","og_type":"article","og_title":"ICO Smart Contract Development: Complete Technical Guide","og_description":"Learn ICO smart contract development: architecture, token and sale contracts, vesting, security, testing, audits and deployment, with code examples.","og_url":"https:\/\/www.coindeveloperindia.com\/blog\/ico-smart-contract-development-guide\/","og_site_name":"Coin Developer India Blog","article_publisher":"https:\/\/facebook.com\/CoinDeveloperIN","article_published_time":"2026-10-22T13:08:28+00:00","article_modified_time":"2026-10-22T13:55:03+00:00","og_image":[{"width":800,"height":450,"url":"https:\/\/www.coindeveloperindia.com\/blog\/wp-content\/uploads\/2026\/10\/coindeveloperindia-blog-8.png","type":"image\/png"}],"author":"Shalu Swami","twitter_card":"summary_large_image","twitter_title":"ICO Smart Contract Development: Complete Technical Guide","twitter_description":"Learn ICO smart contract development: architecture, token and sale contracts, vesting, security, testing, audits and deployment, with code examples.","twitter_creator":"@CoinDeveloperIN","twitter_site":"@CoinDeveloperIN","twitter_misc":{"Written by":"Shalu Swami","Est. reading time":"25 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.coindeveloperindia.com\/blog\/ico-smart-contract-development-guide\/#article","isPartOf":{"@id":"https:\/\/www.coindeveloperindia.com\/blog\/ico-smart-contract-development-guide\/"},"author":{"name":"Shalu Swami","@id":"https:\/\/www.coindeveloperindia.com\/blog\/#\/schema\/person\/9c956fd77b089f30c50893e835725532"},"headline":"ICO Smart Contract Development: Complete Technical Guide","datePublished":"2026-10-22T13:08:28+00:00","dateModified":"2026-10-22T13:55:03+00:00","mainEntityOfPage":{"@id":"https:\/\/www.coindeveloperindia.com\/blog\/ico-smart-contract-development-guide\/"},"wordCount":4068,"commentCount":0,"publisher":{"@id":"https:\/\/www.coindeveloperindia.com\/blog\/#organization"},"image":{"@id":"https:\/\/www.coindeveloperindia.com\/blog\/ico-smart-contract-development-guide\/#primaryimage"},"thumbnailUrl":"https:\/\/www.coindeveloperindia.com\/blog\/wp-content\/uploads\/2026\/10\/coindeveloperindia-blog-8.png","articleSection":["ICO development services"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.coindeveloperindia.com\/blog\/ico-smart-contract-development-guide\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.coindeveloperindia.com\/blog\/ico-smart-contract-development-guide\/","url":"https:\/\/www.coindeveloperindia.com\/blog\/ico-smart-contract-development-guide\/","name":"ICO Smart Contract Development: Complete Technical Guide","isPartOf":{"@id":"https:\/\/www.coindeveloperindia.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.coindeveloperindia.com\/blog\/ico-smart-contract-development-guide\/#primaryimage"},"image":{"@id":"https:\/\/www.coindeveloperindia.com\/blog\/ico-smart-contract-development-guide\/#primaryimage"},"thumbnailUrl":"https:\/\/www.coindeveloperindia.com\/blog\/wp-content\/uploads\/2026\/10\/coindeveloperindia-blog-8.png","datePublished":"2026-10-22T13:08:28+00:00","dateModified":"2026-10-22T13:55:03+00:00","description":"Learn ICO smart contract development: architecture, token and sale contracts, vesting, security, testing, audits and deployment, with code examples.","breadcrumb":{"@id":"https:\/\/www.coindeveloperindia.com\/blog\/ico-smart-contract-development-guide\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.coindeveloperindia.com\/blog\/ico-smart-contract-development-guide\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.coindeveloperindia.com\/blog\/ico-smart-contract-development-guide\/#primaryimage","url":"https:\/\/www.coindeveloperindia.com\/blog\/wp-content\/uploads\/2026\/10\/coindeveloperindia-blog-8.png","contentUrl":"https:\/\/www.coindeveloperindia.com\/blog\/wp-content\/uploads\/2026\/10\/coindeveloperindia-blog-8.png","width":800,"height":450,"caption":"ICO smart contract development complete technical guide with Solidity code and security shield"},{"@type":"BreadcrumbList","@id":"https:\/\/www.coindeveloperindia.com\/blog\/ico-smart-contract-development-guide\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.coindeveloperindia.com\/blog\/"},{"@type":"ListItem","position":2,"name":"ICO Smart Contract Development: Complete Technical Guide"}]},{"@type":"WebSite","@id":"https:\/\/www.coindeveloperindia.com\/blog\/#website","url":"https:\/\/www.coindeveloperindia.com\/blog\/","name":"Coin Developer India Blog","description":"","publisher":{"@id":"https:\/\/www.coindeveloperindia.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.coindeveloperindia.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.coindeveloperindia.com\/blog\/#organization","name":"Coin Developer India","url":"https:\/\/www.coindeveloperindia.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.coindeveloperindia.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.coindeveloperindia.com\/blog\/wp-content\/uploads\/2025\/02\/cropped-logo.png","contentUrl":"https:\/\/www.coindeveloperindia.com\/blog\/wp-content\/uploads\/2025\/02\/cropped-logo.png","width":258,"height":50,"caption":"Coin Developer India"},"image":{"@id":"https:\/\/www.coindeveloperindia.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/facebook.com\/CoinDeveloperIN","https:\/\/x.com\/CoinDeveloperIN"]},{"@type":"Person","@id":"https:\/\/www.coindeveloperindia.com\/blog\/#\/schema\/person\/9c956fd77b089f30c50893e835725532","name":"Shalu Swami","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.coindeveloperindia.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/www.coindeveloperindia.com\/blog\/wp-content\/uploads\/2026\/09\/shalu-swami-150x150.webp","contentUrl":"https:\/\/www.coindeveloperindia.com\/blog\/wp-content\/uploads\/2026\/09\/shalu-swami-150x150.webp","caption":"Shalu Swami"},"description":"Shalu Swami is the Director of Coin Developer India, specializing in blockchain and cryptocurrency development. Her expertise includes smart contracts, crypto exchanges, token development, DeFi, Web3, and Real-World Asset (RWA) tokenization. She reviews and contributes to Coin Developer India\u2019s technical content, focusing on accurate, practical, and industry-relevant blockchain insights."}]}},"_links":{"self":[{"href":"https:\/\/www.coindeveloperindia.com\/blog\/wp-json\/wp\/v2\/posts\/5568","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.coindeveloperindia.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.coindeveloperindia.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.coindeveloperindia.com\/blog\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/www.coindeveloperindia.com\/blog\/wp-json\/wp\/v2\/comments?post=5568"}],"version-history":[{"count":3,"href":"https:\/\/www.coindeveloperindia.com\/blog\/wp-json\/wp\/v2\/posts\/5568\/revisions"}],"predecessor-version":[{"id":5574,"href":"https:\/\/www.coindeveloperindia.com\/blog\/wp-json\/wp\/v2\/posts\/5568\/revisions\/5574"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.coindeveloperindia.com\/blog\/wp-json\/wp\/v2\/media\/5569"}],"wp:attachment":[{"href":"https:\/\/www.coindeveloperindia.com\/blog\/wp-json\/wp\/v2\/media?parent=5568"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.coindeveloperindia.com\/blog\/wp-json\/wp\/v2\/categories?post=5568"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.coindeveloperindia.com\/blog\/wp-json\/wp\/v2\/tags?post=5568"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}