Composability Gotchas

composability.md

Ethereum Composability Security Guidelines

The following is an informal compendium of ways you can screw up when mixing and matching smart contracts:

ERC20

• Be aware of front running on changes to the allowed value.
• Be aware that some tokens don't return a boolean on success or failure.
• Some token balances change overtime, even without a transfer.
  • Use balanceOf(addr) over internal accounting. (https://medium.com/trustless-fund/atoken-withdrawal-vulnerability-disclosure-5d8eadc64539)

ERC777

• These tokens have the same interface as ERC20, but they enable reentrancy. Use a mutex, or strictly adhere to checks effects interactions.

Automated market makers

• Watch out for rounding errors

Commit reveal schemes

• Watch out for replay attacks

Signature validation

• calls to EOAs return true!

Withdrawals

• Push over pull

Upgradability

• Selector colissions

Meta Transactions

• Watch out for Gas grieffing attacks