fravoll / solidity-patterns

A compilation of patterns and best practices for the smart contract programming language Solidity

Solidity Patterns

This repository contains a collection of design and programming patterns for the smart contract programming language Solidity in version 0.4.20. Note that newer versions might have changed some of the functionalities. Each pattern consists of a code sample and a detailed explanation, including background, implications and additional information about the patterns.

Have a look at the documentation site: https://fravoll.github.io/solidity-patterns/

Contents

• Behavioral Patterns
  • Guard Check: Ensure that the behavior of a smart contract and its input parameters are as expected.
  • State Machine: Enable a contract to go through different stages with different corresponding functionality exposed.
  • Oracle: Gain access to data stored outside of the blockchain.
  • Randomness: Generate a random number of a predefined interval in the deterministic environment of a blockchain.
• Security Patterns
  • Access Restriction: Restrict the access to contract functionality according to suitable criteria.
  • Checks Effects Interactions: Reduce the attack surface for malicious contracts trying to hijack control flow after an external call.
  • Secure Ether Transfer: Secure transfer of ether from a contract to another address.
  • Pull over Push: Shift the risk associated with transferring ether to the user.
  • Emergency Stop: Add an option to disable critical contract functionality in case of an emergency.
• Upgradeability Patterns
  • Proxy Delegate: Introduce the possibility to upgrade smart contracts without breaking any dependencies.
  • Eternal Storage: Keep contract storage after a smart contract upgrade.
• Economic Patterns
  • String Equality Comparison: Check for the equality of two provided strings in a way that minimizes average gas consumption for a large number of different inputs.
  • Tight Variable Packing: Optimize gas consumption when storing or loading statically-sized variables.
  • Memory Array Building: Aggregate and retrieve data from contract storage in a gas efficient way.

Disclaimer

This repository is not under active development anymore and some (if not most) sections might be outdated. There is no liability for any damages caused by the use of one of these patterns.

solidity-patterns's Issues

Xrp

Fine,..$999.() of coin)* :in; wallets .,

GitHub Pages broken links

Well, maybe it's not that essential, but last 5 links in your documentation (site version) leads to Not found (but works fine if manually change to html version and without dot, in the beginning, you know). Everything else is great, by the way.

Oraclize version and exchange API endpoint require updating

Within solidity-patterns/Oracle/oracle.sol:

The oraclize import should be changed to "github.com/oraclize/ethereum-api/oraclizeAPI_0.4.sol" to maintain compatibility (the other option being updating the compiler version to 0.5.0).

Also, the api.fixer.io endpoint is now deprecated, and the new endpoint requires an API key to use. To fix this, the "https://api.exchangeratesapi.io/latest?symbols=USD" endpoint can be used as a drop-in replacement to the fixer endpoint.

Thanks!

requires updating?

Not sure if there is error, or just change in compiler, but in your code you've got strings, a b compared with return keccak256(a)==keccak256(b) which doesn't compile, needs `keccak256(bytes(a))==keccak256(bytes(b));

Add mention to PREVRANDAO as a possible source of randomness

Since the merge, the Ethereum network has replaced block difficulty with the random number that determined which validator gets to validate a block.

It's used by OpenSea's SeaDrop when trying to shift all token IDs by some random number to ensure a fairer distribution:

https://github.com/ProjectOpenSea/seadrop/blob/main/src/extensions/ERC721PartnerSeaDropRandomOffset.sol#L68

More about it here: https://soliditydeveloper.com/prevrandao

Is the sealedSeed in Randomness contract secure?

Hey, one concern I had about the contract sample in your article is the state variable bytes32 sealedSeed; is stored in the first slot of the contract storage. Isn't this easily accessed by web3.eth.getStorageAt(contractAddr, 0) function? A malicious attacker can read the seed and make a sure bet.

Error [contracts/oracle.sol:19:39: TypeError: Data location must be "memory"]

Hello,

When trying to run the sample at https://fravoll.github.io/solidity-patterns/oracle.html
In Remix.Ethereum.Org
I have the following error :

contracts/oracle.sol:19:39: TypeError: Data location must be "memory" for parameter in function, but none was given.
function __callback(bytes32 myid, string result) public {
^-----------^

Not under active development but...

Will a PR have a chance to be merged if we do all the work? I was thinking of updating your oracles and randomness section.

Add security warnings

This is a great resource. 👏

One thing I'd suggest is a brief warning somewhere attached to each pattern to indicate that the code hasn't been audited, and you're making no promises about correctness or safety (unless you have/are). This would be similar to the safe/unsafe patters in our best practices

It's really important in our space to build a culture of security, and this is a small example of how that manifests.

4 wks or 4 months?

"Therefore, guaranteeing that the function call can only be successful after at least four months have passed since the last change."?

Is this suppose to read "at least four weeks" instead of four months?

Ref: https://github.com/fravoll/solidity-patterns/blob/master/docs/access_restriction.md

Diamond Pattern

I suggest adding an entry about diamonds from EIP-2535 Diamond Standard: https://eips.ethereum.org/EIPS/eip-2535

It is an important new Solidity pattern getting adopted by new projects. More info here: https://dev.to/mudgen

Add License for both documentations and source codes.

It would be helpful if there's explicit license name on each objects in this repository.
(e.g, MIT, GPLv3, etc)

We are planning to make Smart Contract Design Pattern repository with code executable environment, and wondering if we could include your patterns or not.

Security Scan of your project

We have scanned your project on https://scanmycode.io for Web2 & Web 3 and Infractructure Cloudnative issues. Including: PHP, Java, Scala, Python, Ruby, Javascript, Typescript, GO, Solidity, DeFi Security, Infrastructure as a Code Best Practice and Security (Docker, Kubernetes (k8s), Terraform AWS, GCP, Azure), Secret Scanning, Dependency Confusion, Trojan Source, Open Source and Proprietary Checks. Feel free to go to https://www.scanmycode.io/defiscan/fravoll/solidity-patterns/ to check your report. If you have any questions or need support on the report please contact us directly. Thank you!

Colony reference -> 404

"Another example is the EtherRouter contract of Colony" in upgrade ×× .md has a broken link in it.