Git-Mirrors/blockchains-security-toolkit
1
0
Fork 0
mirror of https://github.com/autistic-symposium/blockchains-security-toolkit.git synced 2025-06-01 04:54:27 -04:00
Code Issues Projects Releases Packages Wiki Activity

Update README.md

Browse source
This commit is contained in:
BT3GL /baɪtɡɝɫ/ 2022-05-14 16:45:22 -07:00 • committed by GitHub
parent 0525972145
commit 7d91ab4611
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 9 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

26
Smart-Contract-Security/README.md
View file

@ -1,23 +1,15 @@
## ☠️ Security
## ☠️ Smart Contract Security
<br>
### Basic security notes
* `tx.origin` is used: you want to replace it by “msg.sender” because otherwise any contract you call can act on your behalf.
* Avoid potential reetrancy bugs:
```
msg.sender.transfer(amount);
balances[msg.sender] -= amount;
```
* Inline assembly should be used only in rare cases.
* Unclear semantics: `now` is alias for `block.timestamp` not current time; use of low level `call`, `callcode`, `delegatecall` should be avoided whenever possible; use `transfer` whenever failure of ether transfer should rollnack the whole transaction.
* Beware of caller contracts: `selfdestruct` can block calling contracts unexpectedly.
* Invocation of local functions via `this`: never use `this` to call functions in the same contract, it only consumes more gas than normal call.
* Transferring Ether in a for/while/do-while loop should be avoid due to the block gas limit.
* ERC20 `decimals` should have `uint8` as return type.
In this repository:
<br>
* [Notes on reentrancy](https://github.com/bt3gl-labs/Blockchain-Development-and-Security/blob/main/Smart-Contract-Security/reentrancy-notes.md)
* [Notes on frontrunning](https://github.com/bt3gl-labs/Blockchain-Development-and-Security/blob/main/Smart-Contract-Security/frontrunning-notes.md)
* [Notes on arithmetic bugs](https://github.com/bt3gl-labs/Blockchain-Development-and-Security/blob/main/Smart-Contract-Security/arithmetic-bugs-notes.md)
* [List of interesting hacks](https://github.com/bt3gl-labs/Blockchain-Development-and-Security/blob/main/Smart-Contract-Security/real-case-hacks.md)
* [A guide for pentesting](https://github.com/bt3gl-labs/Blockchain-Development-and-Security/blob/main/Smart-Contract-Security/pentesting.md)
* [Random security notes](https://github.com/bt3gl-labs/Blockchain-Development-and-Security/blob/main/Smart-Contract-Security/random-notes.md)