Ethereum Composability Security Guidelines
The following is an informal compendium of ways you can screw up when mixing and matching smart contracts:
- Be aware of front running on changes to the
- Be aware that some tokens don't return a boolean on success or failure.
- Some token balances change overtime, even without a transfer.
balanceOf(addr)over internal accounting. (https://medium.com/trustless-fund/atoken-withdrawal-vulnerability-disclosure-5d8eadc64539)
- These tokens have the same interface as ERC20, but they enable reentrancy. Use a mutex, or strictly adhere to checks effects interactions.
Automated market makers
- Watch out for rounding errors
Commit reveal schemes
- Watch out for replay attacks
- calls to EOAs return true!
- Push over pull
- Selector colissions
- Watch out for Gas grieffing attacks