Security Practices

function withdraw(uint256 amount) external {
    require(balances[msg.sender] >= amount);
    balances[msg.sender] -= amount; // Update state first
    (bool success,) = msg.sender.call{value: amount}("");
    require(success);
}

import "@openzeppelin/contracts/utils/ReentrancyGuard.sol";

contract MyContract is ReentrancyGuard {
    function withdraw(uint256 amount) external nonReentrant {
        // Withdrawal logic
    }
}

import "@openzeppelin/contracts/access/Ownable.sol";

contract MyToken is Ownable {
    function mint(address to, uint256 amount) external onlyOwner {
        _mint(to, amount);
    }
}

require(msg.sender == owner); // CORRECT
// Never: require(tx.origin == owner);

import "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";

using SafeERC20 for IERC20;
token.safeTransfer(to, amount); // Reverts on failure

// GOOD - pull pattern
mapping(address => uint256) public rewards;

function claimReward() external {
    uint256 reward = rewards[msg.sender];
    rewards[msg.sender] = 0;
    payable(msg.sender).transfer(reward);
}

pip3 install slither-analyzer
slither contracts/MyContract.sol

pip3 install mythril
myth analyze contracts/MyContract.sol

import "@openzeppelin/contracts/utils/Pausable.sol";

contract MyContract is Pausable, Ownable {
    function emergencyPause() external onlyOwner {
        _pause();
    }

    function transfer(address to, uint256 amount) external whenNotPaused {
        // Transfer logic
    }
}

uint256 public maxDailyWithdraw = 1000000;
uint256 public dailyWithdrawn;
uint256 public lastResetTime;

function withdraw(uint256 amount) external {
    if (block.timestamp > lastResetTime + 1 days) {
        dailyWithdrawn = 0;
        lastResetTime = block.timestamp;
    }

    require(dailyWithdrawn + amount <= maxDailyWithdraw, "Daily limit");
    dailyWithdrawn += amount;
    _withdraw(amount);
}