Smart Contract Security

Smart contract mengelola jutaan dolar. Satu bug bisa berakibat kehilangan seluruh dana, dan kode tidak bisa diperbaiki setelah deploy. Memahami kerentanan umum dan pola audit adalah skill wajib bagi Web3 developer.

Reentrancy Attack

Vulnerability paling terkenal — penyebab DAO Hack 2016 ($60M):

// VULNERABLE contract
contract VulnerableVault {
    mapping(address => uint256) public balances;

    function withdraw() public {
        uint256 amount = balances[msg.sender];
        // BUG: Kirim ETH SEBELUM update state
        (bool success, ) = msg.sender.call{value: amount}("");
        require(success);
        balances[msg.sender] = 0; // Terlambat! Attacker sudah re-enter
    }
}

// ATTACKER contract
contract Attacker {
    VulnerableVault vault;

    function attack() public payable {
        vault.deposit{value: 1 ether}();
        vault.withdraw();
    }

    // receive() dipanggil saat menerima ETH
    receive() external payable {
        if (address(vault).balance >= 1 ether) {
            vault.withdraw(); // Re-enter! balances belum di-update
        }
    }
}

// FIX: Checks-Effects-Interactions pattern
function withdrawSecure() public {
    uint256 amount = balances[msg.sender];
    require(amount > 0);             // CHECK
    balances[msg.sender] = 0;         // EFFECT (update state DULU)
    (bool success, ) = msg.sender.call{value: amount}(""); // INTERACTION
    require(success);
}

Integer Overflow/Underflow

// Sebelum Solidity 0.8: overflow tidak di-check!
// uint8 max = 255; max + 1 = 0 (overflow)

// Solidity 0.8+ otomatis revert pada overflow
// Tapi `unchecked` block bisa bypass ini:

unchecked {
    uint8 x = 255;
    x++; // x = 0, TIDAK revert
    // Hanya gunakan unchecked jika YAKIN tidak overflow
}

Access Control

// BAD: Siapa saja bisa panggil
function mint(address to, uint256 amount) public {
    _mint(to, amount);
}

// GOOD: Gunakan access control
import "@openzeppelin/contracts/access/AccessControl.sol";

contract SecureToken is ERC20, AccessControl {
    bytes32 public constant MINTER_ROLE = keccak256("MINTER_ROLE");

    function mint(address to, uint256 amount) public onlyRole(MINTER_ROLE) {
        _mint(to, amount);
    }
}

Common Vulnerabilities

Security Tools

• Slither — Static analysis tool dari Trail of Bits
• Mythril — Symbolic execution untuk vulnerability detection
• OpenZeppelin — Audited library (selalu gunakan!)
• Echidna — Fuzzing tool untuk smart contracts

Audit Checklist

• Gunakan OpenZeppelin contracts (battle-tested)
• Ikuti Checks-Effects-Interactions pattern
• Gunakan ReentrancyGuard untuk fungsi yang transfer value
• Validasi semua input (zero address, zero amount)
• Limit function access dengan modifiers / roles
• Professional audit sebelum deploy ke mainnet