OpenZeppelin Solidity Best Practices

Apply these rules whenever writing, reviewing, or auditing Solidity smart contracts that use OpenZeppelin v5.x.

Library & Imports

Use OpenZeppelin Contracts v5.x. Import from @openzeppelin/contracts (or @openzeppelin/contracts-upgradeable for upgradeable variants).
Always use named imports: import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol"
Import only what is used. Prefer interface imports (IERC20, IERC721) when only type information is needed.
Pin the exact OZ version in package.json or foundry.toml; never use "latest".
OZ v5 removed SafeMath; rely on Solidity 0.8.x built-in overflow protection instead.
OZ v5 Ownable requires passing initialOwner to the constructor; passing address(0) reverts.
ERC-721 v5 replaced _beforeTokenTransfer / _afterTokenTransfer with a single _update(to, tokenId, auth) hook.