Smart Contract Code Weaknesses and Solutions

Explore function default visibility in smart contracts, including private, internal, external, and public, and learn how explicit visibility impacts security and gas usage.

Examine how integer overflow and underflow affect smart contracts, understand unsigned and signed integers of 8 to 256 bits, and apply safe libraries and input validation.

Update and specify the latest compiler version in your smart contracts using pragma. Avoid outdated versions that introduce vulnerabilities and compatibility issues; test and compile with remix.

Learn how floating compiler versions affect smart contract behavior across versions, risks of unknown behaviors, and the importance of using a tested, fixed compiler version for reliable maintenance.

Identify the unchecked return value weakness in smart contracts and explain how validating the call result with boolean checks on low-level calls prevents attackers from manipulating subsequent logic.

Examine unprotected ether withdrawal and the importance of access control in smart contracts, including constructor exposure, balance visibility, and authorized withdrawal patterns.

Identify unprotected self-destruct instructions and the risk of contract disruption due to improper access control. Adopt multi-signature and multi-phase approvals with two consecutive transactions and two approvals from different accounts.

Explain the reentrancy vulnerability by showing how a malicious contract can re-enter during a withdrawal, causing double payments. Apply the check-effects-interactions pattern and a reentrancy lock to secure smart contracts.

Explore default visibility of state variables and define explicit public, private, or internal visibility to avoid SWC 1 or 8 weaknesses.

Explore how uninitialized storage pointers arise in smart contracts, the difference between memory and storage, and how explicit storage pointers and compiler warnings help prevent accidental overwrites.

Explore assert violations in smart contracts, distinguishing invariants from input validation, and learn when to use require, assert, or revert to prevent unsafe state changes.

Explore Verisol, a Microsoft prototype for formal verification of smart contracts, classifying contracts as verified, violation, or partially verified, with installation and usage guidance for the verification tool.

Identify deprecated solidity functions and their consequences for stage development, noting compiler warnings, possible compile errors, and the need to update to newer versions via the SWC registry and Remix.

Delegatecall runs code in the caller's context, requiring matching storage layouts. Avoid untrusted callee by validating target addresses and using controlled proxy patterns to prevent ownership hijack.

Explore how denial of service attacks arise in smart contracts through failed external calls, and learn to favor pull over push for withdrawals to mitigate risk.

Learn to use Oyente, a smart contract auditing tool, and master its installation on Windows with Docker and WSL while recognizing bugs like integer overflow and timestamp dependency.

Explore transaction order dependence in smart contracts, illustrating race conditions, front-running attacks, and ERC-20 vulnerabilities, and explain commit-reveal remedies and how to avoid such attacks.

Analyze how tx.origin differs from msg.sender and why using tx.origin for authorization creates vulnerabilities, and learn to mitigate with msg.sender checks and smart contract tunnels.

Explore Manticore, an open source dynamic security analysis tool for smart contracts, using symbolic execution to explore inputs, generate test cases, and discover errors via a Python API.

Explore signature malleability, signatures in public key cryptography, and how elliptic curve operations enable secure signing and verification in smart contracts. Learn about the recover function and replay attack prevention.

Identify and fix incorrect constructor names in smart contracts to prevent improper initialization, using the constructor keyword and avoiding misnamed functions and fallback function misuse.

Understand how shadowing state variables in inherited contracts creates two x variables, risks security issues, and how compiler warnings help reveal and fix variable layouts.

Learn how chain attributes like block hash, timestamp, and difficulty fail as random sources, and how commitment scams, XOR-based schemes, and oracles mitigate these weaknesses in smart contract campaigns.

Explore missing protection against signature replay attacks, including storing processed message hashes, rejecting reused signatures, and use cases for multi-signature and unlock operations.

Examine flaws in signature verification for smart contracts, highlighting off-chain signing risks, proxy attacks, and the recover-based verification approach to ensure data authenticity and prevent replay.

Explain how smart contracts validate external inputs against requirements, diagnose pre-condition violations, and how strong requirements or bugs can disrupt settlement, consensus, and bytecode execution.

Explore how writing to arbitrary storage locations creates security risks in smart contracts. Learn to distinguish storage from memory to protect contract state.

Understand how incorrect inheritance order in multiple inheritance causes ambiguity and wrong function calls, explore the diamond problem, and learn to order contracts from general to specific and use super.

Slither enables vulnerability detection for Solidity smart contracts with high accuracy, integrates with Truffle, and offers printers like call graph and inheritance to visualize dependencies.

Examine insufficient gas griefing in smart contracts, where low gas induces censorship by failing a sub-call, and learn mitigation by ensuring enough gas for forwarder operations.

Explore how function type variables enable an arbitrary jump vulnerability when combined with assembly in smart contracts, and learn safe patterns and minimal assembly remediation to prevent abuse.

Learn to estimate gas, set safe gas limits, and understand gas price to manage blockchain costs. Discover how block gas limits cause denial of service and how to avoid loops.

Explore Open Zeppelin, a widely used open-source smart contract library of utilities and templates under MIT license. Learn installation, importing contracts, and leveraging audits and defender for secure blockchain apps.

Explore OpenZeppelin access control, from owner-only checks and ownership risks to role-based controls with bytes32 role IDs, grant and revoke flows, and admin roles.

Explain how the right-to-left override control character in Unicode can be misused to render text right-to-left in smart contracts, and how to detect and prevent phishing risks in source code.

Learn about common tokens and standards like ERC-20 and ERC-721, how token contracts enable interaction, exchange, and specialized features, and review audited OpenZeppelin implementations for security.

Identify the presence of unused variables as a bad coding habit and remove them to reduce code noise, improve readability, and avoid unnecessary gas consumption in smart contracts.

Explore how the self-destruct method can force ether from a contract to a designated address, enabling attack contracts and denial-of-service risks.

Understand how ABI packed encoding of multiple variable length arguments can cause hash collisions and authentication bypass in smart contracts, and explore fixes like fixed length arrays.

Examine the hardcoded gas curse in smart contract calls, comparing transfer, send, and call methods with fixed gas limits. Evaluate why fixed gas risks and the fallback function impact security.

Identify non-executing code, or death code, in smart contracts and remove it to prevent logic errors. Learn to ensure code has effects, implement testing, and verify operations perform as intended.

Examine the unencrypted private data on-chain weakness, showing how contract state is readable through transactions and public methods, and why private data should be off-chain or carefully encrypted.

Review around 40 security problems in smart contracts and their solutions, including patents. Demonstrate the use of automatic smart contract scanners and resources like OpenVPN and libraries for real-world application.