From 052597214597fb793f259082e7abc97d077066a2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?BT3GL=20/ba=C9=AAt=C9=A1=C9=9D=C9=AB/?=
 <1130416+bt3gl@users.noreply.github.com>
Date: Sat, 14 May 2022 16:43:30 -0700
Subject: [PATCH] Create random-notes.md

---
 Smart-Contract-Security/random-notes.md | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)
 create mode 100644 Smart-Contract-Security/random-notes.md

diff --git a/Smart-Contract-Security/random-notes.md b/Smart-Contract-Security/random-notes.md
new file mode 100644
index 0000000..c979b0e
--- /dev/null
+++ b/Smart-Contract-Security/random-notes.md
@@ -0,0 +1,18 @@
+## Random security notes
+
+<br>
+
+* `tx.origin` is used: you want to replace it by “msg.sender” because otherwise any contract you call can act on your behalf.
+* Avoid potential reetrancy bugs: 
+```
+msg.sender.transfer(amount);
+balances[msg.sender] -= amount;
+```
+* Inline assembly should be used only in rare cases.
+* Unclear semantics: `now` is alias for `block.timestamp` not current time; use of low level `call`, `callcode`, `delegatecall` should be avoided whenever possible; use `transfer` whenever failure of ether transfer should rollnack the whole transaction.
+* Beware of caller contracts: `selfdestruct` can block calling contracts unexpectedly.
+* Invocation of local functions via `this`: never use `this` to call functions in the same contract, it only consumes more gas than normal call.
+* Transferring Ether in a for/while/do-while loop should be avoid due to the block gas limit.
+* ERC20 `decimals` should have `uint8` as return type.
+
+<br>