bartubozkurt

/* Bad */
int totalValue = 275000;
int percentage = 2;
for (uint i = 0; i < 30; i++) {
  totalValue += totalValue * percentage / 100;
}
/*
Exact value: 498124.436
Result: 498108
*/

bartubozkurt

/* Bad */
pragma solidity =0.4.11;
contract Bad {
  mapping(address => uint256) balances;
  function badWithdraw(uint256 amounts) public {
  require(amounts <= balances[msg.sender]);
  balances[msg.sender] -= amounts; 
  (bool success, bytes memory data) = msg.sender.call{value: amounts}(""); 
  require(success);
  }

bartubozkurt

/* Bad */
contract TimedCrowdsale {

  event Finished();
  event notFinished();

  // Sale should finish exactly at January 1, 2019
  function isSaleFinished() private returns (bool) {
    return block.timestamp >= 1546300800;
  }

bartubozkurt

/* Bad */
function getRandomNum() public view returns(uint256 randomNum_) {
    randomNum_ = uint256(keccak256(block.blockhash(block.number - 1), now))
  }

/* Better */
// Using VRF by Chainlink
// https://docs.chain.link/docs/vrf/v2/examples/get-a-random-number/

bartubozkurt

/* Bad */
string private password;

/* Better */
// string private password
// shouldn't store the password on blockchain

bartubozkurt

/* Bad */
function badWithdraw(uint amounts) public {
  require(amounts <= balances[msg.sender]); // 1.𝗖𝗛𝗘𝗖𝗞
  // there is no risk of reentrancy because transfer is 2300 gas
  msg.sender.transfer(amounts) // 3.𝗜𝗡𝗧𝗘𝗥𝗔𝗖𝗧𝗜𝗢𝗡
  balances[msg.sender] - amounts; // 2.𝗘𝗙𝗙𝗘𝗖𝗧𝗦
}

/* Better */
function goodWithdraw(uint amounts) public {

bartubozkurt

 contract Guarded {
    ...
 
    bool locked = false;
 
    function withdraw() external {
        require(!locked, "Reentrant call detected!");
        locked = true;
        ...
        locked = false;

bartubozkurt

address token;
mapping(address => uint) canBorrowAmount;
/* Bad */
function badBorrow(uint amounts) public {
    require(amounts <= canBorrowAmount[msg.sender]); // 1.𝗖𝗛𝗘𝗖𝗞
    IERC777(token).transfer(msg.sender, amounts) // 3.𝗜𝗡𝗧𝗘𝗥𝗔𝗖𝗧𝗜𝗢𝗡
    canBorrowAmount[msg.sender] - amounts; // 2.𝗘𝗙𝗙𝗘𝗖𝗧𝗦
  }

/* Better */

bartubozkurt

/* Bad */
function badWithdraw(uint amounts) public {
    require(amounts <= balances[msg.sender]); // 1.𝗖𝗛𝗘𝗖𝗞
    (bool success, bytes memory data)
		= msg.sender.call{value: amounts}(""); // 3.𝗜𝗡𝗧𝗘𝗥𝗔𝗖𝗧𝗜𝗢𝗡
    require(success);
    balances[msg.sender] - amounts; // 2.𝗘𝗙𝗙𝗘𝗖𝗧𝗦
  }

/* Better */

bartubozkurt

/* Bad */
contract Bad {
	function badDelegate(address _yourContract, bytes calldata _data) payable public returns (bytes memory) {
	    (bool success, bytes memory data) =  _yourContract.delegatecall(_data);
	    require(success);
	    return data;
	}
}
/* Vulnerability
Anyone can destroy the Bad contract using by “selfdestruct”