solidity-security

Solidity Security Fundamentals

Reentrancy Guards

Always use ReentrancyGuard on functions with external interactions, even when following CEI.

import {ReentrancyGuard} from "@openzeppelin/contracts/utils/ReentrancyGuard.sol";

contract Vault is ReentrancyGuard {
    mapping(address => uint256) public balances;

    function withdraw(uint256 amount) external nonReentrant {
        if (balances[msg.sender] < amount) revert InsufficientBalance();

        balances[msg.sender] -= amount;

        (bool success,) = msg.sender.call{value: amount}("");
        if (!success) revert TransferFailed();
    }
}

SafeERC20 — Always Use It

Token contracts are not standardized in practice. USDT does not return a bool on transfer. USDC uses 6 decimals (not 18). Some tokens have fee-on-transfer. Always use SafeERC20.

import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {SafeERC20} from "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";

contract TokenVault {
    using SafeERC20 for IERC20;

    function deposit(IERC20 token, uint256 amount) external {
        // SafeERC20 handles non-standard return values
        token.safeTransferFrom(msg.sender, address(this), amount);
    }

    function withdraw(IERC20 token, uint256 amount) external {
        token.safeTransfer(msg.sender, amount);
    }

    function approveSpender(IERC20 token, address spender, uint256 amount) external {
        // forceApprove handles tokens requiring approval reset to 0 first (USDT)
        token.forceApprove(spender, amount);
    }
}

Token Decimal Gotchas

// WRONG: assuming 18 decimals
uint256 oneToken = 1e18;

// RIGHT: query decimals
uint8 decimals = IERC20Metadata(address(token)).decimals();
uint256 oneToken = 10 ** decimals;

// Common decimals:
// USDC: 6 decimals  (1 USDC = 1e6)
// USDT: 6 decimals  (1 USDT = 1e6)
// WBTC: 8 decimals  (1 WBTC = 1e8)
// DAI:  18 decimals (1 DAI  = 1e18)
// WETH: 18 decimals (1 WETH = 1e18)