Solidity

Reentrancy

• External calls before state updates — attacker can re-enter before state changes
• Checks-Effects-Interactions pattern — validate, update state, THEN external call
• ReentrancyGuard from OpenZeppelin — use nonReentrant modifier on vulnerable functions
• transfer() and send() have 2300 gas limit — but don't rely on this for security

Integer Handling

• Solidity 0.8+ reverts on overflow — but unchecked {} blocks bypass this
• Division truncates toward zero — 5 / 2 = 2, no decimals
• Use fixed-point math for precision — multiply before divide, or use libraries
• type(uint256).max for max value — don't hardcode large numbers

Gas Gotchas

• Unbounded loops can exceed block gas limit — paginate or limit iterations
• Storage writes cost 20k gas — memory/calldata much cheaper
• delete refunds gas but has limits — refund capped, don't rely on it
• Reading storage in loop — cache in memory variable first