Solidity Security

Defensive Solidity patterns that prevent the vulnerabilities behind 90%+ of DeFi exploits. Every section shows the broken pattern first, then the fix. Code is Solidity 0.8.20+ unless noted.

What You Probably Got Wrong

LLMs generate plausible but exploitable Solidity. These are the blind spots that cause real losses.

• USDC/USDT are 6 decimals, not 18 — 1e18 assumptions silently inflate or truncate amounts by 1e12. Always read IERC20Metadata(token).decimals() onchain.
• Solidity has no floating point — Writing amount * 0.03 does not compile. Use basis points: amount * 300 / 10_000.
• 0.8.x does NOT prevent all overflow — Checked math covers +, -, *, / on standard types. It does NOT protect unchecked {} blocks, assembly, bitwise ops, or casting between smaller types (uint256 to uint128).
• transfer() and send() are not safe — They forward only 2300 gas. Since EIP-1884 repriced SLOAD, many contracts and multisigs (Gnosis Safe) cannot receive ETH via transfer(). Use call{value:}("") with reentrancy protection.
• ERC20 approve is not universal — USDT requires resetting allowance to 0 before setting a new value. Use OpenZeppelin SafeERC20.
• msg.sender changes in delegatecall — In proxy patterns, msg.sender in the implementation is the caller, not the proxy. But address(this) is the proxy's address. Confusing these causes critical auth bugs.
• block.timestamp is manipulable — Miners/validators can shift it by ~15 seconds. Never use it as sole entropy or for tight time windows.

Critical Vulnerabilities

1. Token Decimal Mismatch