Git-Mirrors/blockchains-security-toolkit
1
0
Fork 0
mirror of https://github.com/autistic-symposium/blockchains-security-toolkit.git synced 2025-07-24 23:25:42 -04:00
Code Issues Projects Releases Packages Wiki Activity

🌭 security tips

Browse source
This commit is contained in:
bt3gl 2022-09-23 07:47:56 -07:00 • committed by GitHub
parent 1e3500848b
commit 99659ac9ce
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 13 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

18
smart_contracts_vulnerabilities/random-notes.md
View file

@ -1,18 +0,0 @@
## Random security notes
<br>
* `tx.origin` is used: you want to replace it by “msg.sender” because otherwise any contract you call can act on your behalf.
* Avoid potential reetrancy bugs:
```
msg.sender.transfer(amount);
balances[msg.sender] -= amount;
```
* Inline assembly should be used only in rare cases.
* Unclear semantics: `now` is alias for `block.timestamp` not current time; use of low level `call`, `callcode`, `delegatecall` should be avoided whenever possible; use `transfer` whenever failure of ether transfer should rollnack the whole transaction.
* Beware of caller contracts: `selfdestruct` can block calling contracts unexpectedly.
* Invocation of local functions via `this`: never use `this` to call functions in the same contract, it only consumes more gas than normal call.
* Transferring Ether in a for/while/do-while loop should be avoid due to the block gas limit.
* ERC20 `decimals` should have `uint8` as return type.
<br>

13
smart_contracts_vulnerabilities/security_tips.md Normal file
View file

@ -0,0 +1,13 @@
## 🌭 security tips
<br>
* `tx.origin` needs to bere placed by `msg.sender`, otherwise any contract you call can act on your behalf.
* inline assembly should be used only in rare cases.
* unclear semantics: `now` is alias for `block.timestamp` not current time; use of low level `call`, `callcode`, `delegatecall` should be avoided whenever possible; use `transfer` whenever failure of ether transfer should rollnack the whole transaction.
* beware of caller contracts: `selfdestruct` can block calling contracts unexpectedly.
* invocation of local functions via `this`: never use `this` to call functions in the same contract, it only consumes more gas than normal call.
* transferring Ether in a for/while/do-while loop should be avoid due to the block gas limit.
* erc20 `decimals` should have `uint8` as return type.
<br>