In this track: Smart contract security foundations
advanced · 4 MIN READ
Security review practice set
Review authority, invariants and progress under hostile conditions.
LET’S PICTURE IT
A good inspection tests how a system fails as well as how it works on a quiet day.
SEE IT FOR YOURSELF
A valid counter call, step by stepStep 1 / 4
This example begins with count zero and a request to call increment(). No real contract is deployed.
This example begins with count zero and a request to call increment(). No real contract is deployed.Execution follows the code’s input and permission rules. A website button is not the access-control mechanism.The function reads zero, calculates zero plus one, and writes one to persistent storage.The accepted state contains count one. Later reads can inspect it. Events are emitted only if the code implements them.
Animated local teaching model. No wallet, RPC or live blockchain data. Some labels and hashes are abbreviated for readability.
Start with protected properties
Write what must remain true: who controls upgrades, how credits are conserved and which users must remain able to exit. These properties guide the review.
Map trust boundaries
List external calls, callback paths, signed requests, oracle inputs and privileged roles. For each, state what is assumed and what is checked.
Construct counterexamples locally
Try unauthorized callers, stale prices, repeated claims, failing recipients and extreme values. A failing property is more informative than a long list of happy-path calls.
Record limits and unresolved risks
Passing tests and a careful review add evidence, but do not prove universal safety. Keep the assumptions, exact build context and unsupported behaviors visible.