Skip to content
This repository was archived by the owner on Dec 10, 2025. It is now read-only.

README.md

Latest commit

聽

History

History
48 lines (31 loc) 路 1.65 KB

README.md

File metadata and controls

48 lines (31 loc) 路 1.65 KB
Raw

smart contract vulnerabilities


initial thoughts


  • tx.origin needs to be replaced by msg.sender, otherwise any contract you call can act on your behalf.
  • inline assembly should be used only in rare cases.
  • unclear semantics: now is alias for block.timestamp not current time; use of low level call, callcode, delegatecall should be avoided whenever possible; use transfer whenever failure of ether transfer should rollback the whole transaction.
  • beware of caller contracts: selfdestruct can block calling contracts unexpectedly.
  • invocation of local functions via this: never use this to call functions in the same contract, it only consumes more gas than normal call.
  • transferring Ether in a for/while/do-while loop should be avoided due to the block gas limit.
  • erc20 decimals should have uint8 as return type.

chapters



cool resources