smart-contract-best-practices

https://github.com/ConsenSys/smart-contract-best-practices/b... Bullet #1: Prepare for failure

You need a reasonable understanding of how Ethereum works (and blockchains in general). The primary language is Solidity, which is pretty simple but has some security gotchas to be aware of. Javascript is most important for writing UI. There's also an API for Go, so that can be pretty helpful. The main clients are written in Go, Rust, C++, and Javascript. Write some open source code, blog about it, participate in the community, and if you impress people they'll come to you. Resources: ethereum.org https://github.com/ethereum/wiki/wiki/White-Paper https://solidity.readthedocs.io/en/develop/solidity-in-depth... https://github.com/ethereum/wiki/wiki/JavaScript-API r/ethereum r/ethdev https://gitter.im/ethereum/home ethereum.stackexchange.com truffleframework.com https://github.com/ConsenSys/smart-contract-best-practices https://medium.com/@w

If you are considering writing a smart contract, you should read this first https://github.com/ConsenSys/smart-contract-best-practices for Solidity security pitfalls, and hopefully have some idea of invariants/contracts to verify expected properties of your smart contract https://www.cs.cmu.edu/~rjsimmon/15122-s16/lec/01-contracts.... and additionally hope the EVM doesn't have unexpected behavior. Anybody know if the legality of exploiting leaky smart contracts has been tested? Since a lawyer can exploit a badly written contract I wonder if somebody who finds a flaw in a smart contract can legally just jack all the coins or alternatively, write purposely obfuscated contracts (underhanded Solidity contest) to run a scam.

The 20 cases for underflow and overflow [0] show how difficult it is to develop error-free contracts. Would have been great if the VM would detect such cases and thus make the contract code less polluted with boundary and overflow checks. Some projects have started sharing audit results publicly directly in their repos [1]. It's a great read to see common errors and yet unsolved issues that originate in the ERC20 token specification. [0] https://github.com/ConsenSys/smart-contract-best-practices#i... [1] https://github.com/status-im/status-network-token#reviewers-...

Poking around in that project, I don't see any specific tests of the Wallet contract... would be interested to see what UTs/STs were included if anyone knows where they are -- or was it just manually tested on the testnet? It seems that a basic set of UTs for this contract should have caught this issue. It's not even in the category of weird timing attacks or complicated internal states allowing unexpected state transitions -- this is a trivial bug that could be spotted by viewing the contract in Remix (the Solidity IDE). There are certainly some weird edge cases in the Ethereum VM programming model that are hard to UT, and I think that dev efforts in this area are under-resourced (e.g. it's currently impossible to test time-dependent contracts as there's no way of mocking out the clock in the simulated blockchain). If you are considering