Smart contract security foundations
Begin with “Checks, effects and interactions” and work toward “Security review practice set”. Each available lesson includes a visual explanation and a quick knowledge check.
Read in order or choose a topic below. Completion marks stay in this browser. All 20 lessons in this track are available.
- 01
Checks, effects and interactions
Make the relevant state consistent before handing control away.
4 MIN READ - 02
Reentrancy explained with a counterexample
An unfinished withdrawal can expose an old entitlement to a callback.
4 MIN READ - 03
Cross-function reentrancy
A callback can enter a different function sharing the same state.
4 MIN READ - 04
Read-only reentrancy
A callback can exploit an inconsistent observation without writing through a view function.
4 MIN READ - 05
Access control mistakes
Sensitive actions need the correct on-chain authority checks.
4 MIN READ - 06
Uninitialized contracts and initializers
An exposed setup function can become an unintended ownership path.
4 MIN READ - 07
Arithmetic checks and unchecked blocks
Removing overflow checks requires a proved bound.
4 MIN READ - 08
Rounding direction in financial code
Integer rounding can shift value between participants.
4 MIN READ - 09
ERC-20 return value differences
Integration code must handle actual token call conventions.
4 MIN READ - 10
Approval race conditions
Replacing an allowance can interact with pending spending.
4 MIN READ - 11
Unsafe external call assumptions
Targets can fail, reenter or return unexpected data.
4 MIN READ - 12
Denial of service in loops
Unbounded work can make a required operation impossible to complete.
4 MIN READ - 13
Unbounded storage growth
Persistent collections need a plan for future access costs.
4 MIN READ - 14
Timestamp dependence
A block timestamp is a protocol input with boundary assumptions.
4 MIN READ - 15
Predictable randomness
Public or influenceable inputs do not automatically form a fair draw.
4 MIN READ - 16
Oracle manipulation basics
A quoted value is only as robust as its source and update rules.
4 MIN READ - 17
Flash loans as a mechanism
Atomic borrowing changes available temporary capital, not arithmetic truth.
4 MIN READ - 18
Slippage and sandwich attacks
Transaction ordering can worsen an execution price.
4 MIN READ - 19
Frontend security versus contract security
A correct contract and a trustworthy interface are separate requirements.
4 MIN READ - 20
Security review practice set
Review authority, invariants and progress under hostile conditions.
4 MIN READ