solidity-security

Prevent reentrancy by following the Checks-Effects-Interactions pattern: update state before making external calls. Alternatively, inherit OpenZeppelin's ReentrancyGuard and apply the nonReentrant modifier to functions that transfer ETH or call external contracts.

Use Solidity 0.8.0 or higher, which includes built-in overflow and underflow checks that automatically revert transactions. For older compiler versions, import OpenZeppelin's SafeMath library and use its add, sub, and mul functions for arithmetic.

Checks-effects-interactions is a function ordering pattern: first validate conditions with require statements, then update contract state, and finally make external calls. This ordering prevents reentrancy because state changes complete before any external contract can call back.

No, Solidity 0.8.0 and later include automatic overflow and underflow checks in the compiler, making SafeMath redundant. SafeMath is only necessary when maintaining contracts compiled with Solidity versions below 0.8.0.

tx.origin identifies the original externally owned account of a transaction chain, so a malicious intermediary contract can trick users into authorizing calls. Always use msg.sender for authentication, which identifies the immediate caller of the function.

Write Hardhat tests that simulate attack scenarios, such as deploying an attacker contract that attempts reentrant calls and asserting the transaction reverts. Use ethers.js with Chai matchers like expect(...).to.be.revertedWith to verify access control and overflow protections.