Delegatecalldelegatecall is a low level function similar to call.When contract A executes delegatecall to contract B, B's code is executed with contract A's storage, msg.sender and msg.value.Common Call: When we call B's function from A, B's code is executed with contract B's storage. x in A is still 0.Delegatecall: When we call B's function from A, B's code is executed with contract A's storage. x in A will be 1.So we get a method to update the contrac...

Delegatecalldelegatecall is a low level function similar to call.When contract A executes delegatecall to contract B, B's code is executed with contract A's storage, msg.sender and msg.value.Common Call: When we call B's function from A, B's code is executed with contract B's storage. x in A is still 0.Delegatecall: When we call B's function from A, B's code is executed with contract A's storage. x in A will be 1.So we get a method to update the contrac...

We can use Proxy contract to update contracts.For some advanced use cases like this one, we cannot use solidity directly so we are going to use assembly to forward our call to the implementation. I will explain all the detail in the comment.

We can use Proxy contract to update contracts.For some advanced use cases like this one, we cannot use solidity directly so we are going to use assembly to forward our call to the implementation. I will explain all the detail in the comment.

For the previous version of 0.6, solidity won’t check the overflow. For a uint8 variable with a maximum value of 255, when adding 1 to it, it will be 0.Example for an attacker to exploit the contract. When the attacker call transfer without any balance, the value will be overflow and will be a very large amount. So the attacker will get a very large amount of tokens.

For the previous version of 0.6, solidity won’t check the overflow. For a uint8 variable with a maximum value of 255, when adding 1 to it, it will be 0.Example for an attacker to exploit the contract. When the attacker call transfer without any balance, the value will be overflow and will be a very large amount. So the attacker will get a very large amount of tokens.

Solution: use “msg.sender” rather than “tx.origin”

Solution: use “msg.sender” rather than “tx.origin”

Reentrancyif a contract calls attack() function with enough gas, the recipient contract will have the chance to perform its own logic.Solution: set Balance before sending ETH to the caller

Reentrancyif a contract calls attack() function with enough gas, the recipient contract will have the chance to perform its own logic.Solution: set Balance before sending ETH to the caller

Inline AssemblyYou can interleave Solidity statements with inline assembly in a language close to one of the Ethereum virtual machine. This gives you more fine-grained control, which is especially useful when you are enhancing the language by writing libraries. You only use assembly if you have no other choice because assembly manipulates directly the memory and it is kind of dangerous.Let's see a simple example. Assembly function: we need to put assembly inside the function. You can man...

Inline AssemblyYou can interleave Solidity statements with inline assembly in a language close to one of the Ethereum virtual machine. This gives you more fine-grained control, which is especially useful when you are enhancing the language by writing libraries. You only use assembly if you have no other choice because assembly manipulates directly the memory and it is kind of dangerous.Let's see a simple example. Assembly function: we need to put assembly inside the function. You can man...

DoS attack in blockchain context:Unexpected RevertBlock Gas LimitBlock StuffingExample for the attack of Block Gas Limit:When attacker calls bid() thousands of times, refundAll() function may hit the gas limit of the block which will lead to the stuck of funds in the contract forever because of Block Gas Limit.Solution: We should let users manually withdraw their funds.

DoS attack in blockchain context:Unexpected RevertBlock Gas LimitBlock StuffingExample for the attack of Block Gas Limit:When attacker calls bid() thousands of times, refundAll() function may hit the gas limit of the block which will lead to the stuck of funds in the contract forever because of Block Gas Limit.Solution: We should let users manually withdraw their funds.