Solidity's most common security pitfalls and its best safeguards
summary
Common Solidity failures are concrete: integer wraparound still appears via unchecked blocks, misordered multiplies/divides cause persistent precision loss that led to a $1M whitehat on Balancer and could have threatened ~20% of a pool, low-level call patterns break with smart-account or gas assumptions, re-entrancy includes malicious ERC‑20 callbacks, and a return bomb of huge returndata can force relays to revert. Remedies: use 0.8 checks, prefer audited fixed‑point libs (PRB‑Math), add reentrancy guards, check call success/returndatasize in assembly, and run Slither/Mythril, thorough unit tests and bug bounties.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 0:49Protocol security path
- 2:45Common security pitfalls
- 3:26Overflow and underflow
- 5:33Dreadful rounding errors
- 7:28External call methods madness
- 9:01Rounding errors
- 10:51Reentrancy
- 12:51Return Bomb
- 14:34Overflow
- 16:54Testing
- 17:57Questions
related talks
25mCommSec D2 - Smart Contract (In)Security
20mLearning How to Build Secure Smart Contracts
43mOutsmarting Smart Contracts
28mSolidity Best Practices - 10 Tips
18mFavorite DeFi Vulnerabilities
01h 31mHow to find Solidity vulnerabilities- 20mLearning How to Build Secure Smart Contracts
36mDeciphering Web3 Security: Implications and Innovations