Secure Development Workflow

Follow this high-level process while developing your smart contracts for enhanced security:

  1. Check for known security issues:
  • Review your contracts using Slither, which has over 70 built-in detectors for common vulnerabilities. Run it on every check-in with new code and ensure it gets a clean report (or use triage mode to silence certain issues).
  1. Consider special features of your contract:
  • If your contracts are upgradeable, review your upgradeability code for flaws using slither-check-upgradeability or Crytic. We have documented 17 ways upgrades can go sideways.
  • If your contracts claim to conform to ERCs, check them with slither-check-erc. This tool instantly identifies deviations from six common specs.
  • If you have unit tests in Truffle, enrich them with slither-prop. It automatically generates a robust suite of security properties for features of ERC20 based on your specific code.
  • If you integrate with third-party tokens, review our token integration checklist before relying on external contracts.
  1. Visually inspect critical security features of your code:
  • Review Slither's inheritance-graph printer to avoid inadvertent shadowing and C3 linearization issues.
  • Review Slither's function-summary printer, which reports function visibility and access controls.
  • Review Slither's vars-and-auth printer, which reports access controls on state variables.
  1. Document critical security properties and use automated test generators to evaluate them:
  • Learn to document security properties for your code. Although challenging at first, it is the single most important activity for achieving a good outcome. It is also a prerequisite for using any advanced techniques in this tutorial.
  • Define security properties in Solidity for use with Echidna and Manticore. Focus on your state machine, access controls, arithmetic operations, external interactions, and standards conformance.
  • Define security properties with Slither's Python API. Concentrate on inheritance, variable dependencies, access controls, and other structural issues.
  1. Be mindful of issues that automated tools cannot easily find:
  • Lack of privacy: Transactions are visible to everyone else while queued in the pool.
  • Front running transactions.
  • Cryptographic operations.
  • Risky interactions with external DeFi components.

Ask for help

Office Hours are held every Tuesday afternoon. These one-hour, one-on-one sessions provide an opportunity to ask questions about security, troubleshoot tool usage, and receive expert feedback on your current approach. We will help you work through this guide.

Join our Slack: Empire Hacking. We are always available in the #crytic and #ethereum channels if you have questions.

Security is about more than just smart contracts

Review our quick tips for general application and corporate security. While it is crucial to ensure on-chain code security, off-chain security lapses can be equally severe, especially regarding owner keys.