Smart Contracts: Coding Best Practices and Security Recommendations by ConsenSys Academy (Devcon5)

[Applause] you know a little bit about the audience and see how we could make better uses the object of your time and understand so how many of you would consider yourself you know in solidity is my contract light you know you're starting with it you're not you know it's the first time to it your new cassette installed and you have noted a few things but you know you're still pretty new okay so I would hear that everybody else considers themselves to be intermediate or advanced level of security all right so I don't know how much what I'm going to say perhaps five already you already know about it so we could have more of a dialogue and you could end and you can have we're gonna have a room at the at the end of the session for some questions that's horrible feel so like when's hollow from diligences here because the word unsecure IAM their everyday basis so if there's a question that I'm not able to address you'll push for being able to at least help me hear it out a way to solve it so how many so how many of you are from our tough take in any class or anything in fright period or how many of you think purses or do you teach yourself how many of you take courses how many of you learn yourself to use most of these all right that's good all right how many of you there like from github or brickel's for people without that's mostly working people learning from if not were they usually if you want to learn about it here where do you go - I'm sorry read the docs you read this back to the docks yes that's a common ones all right it does have a curiosity goes for always have on how many people here is consensus yeah well alright so let's see bigger get started as on a favor government schools have actually don't give us out there for more time of work on this so considering that most of the audience says advance for each immediate I'll try to go maybe a little bit fast about about some of the topics also I don't know how well some of the code will be we will be able to defeat it on the back so we'll see how that goes so we have more time for questions and answers or like concerns about audio address for focus security and maybe even some of the things tell you a little bit more about you know how audits are conducted for smart contracts alright so let me go back to first of all welcome so I'll choose my cell gentle debt consolidation use them self so my name is Carlos I got involved in the blockchain space and in 2014 I might start up at that time and basically I was just you know trying to I was using become logged in to stamp documents because my startup were having a lot of documentation and using DocuSign didn't seem like something a start up with you so I started with it but to be honest I didn't really got like he didn't excited me that much then but I write with here and that for me was really a mind and he made me get into the space a little a little have been doing things in the space also I join consensus I think about in almost two years perhaps and I worked in the educational arm a little bit more about it later but also in this session dominant in today's YouTube consult they react in Vegas theme that I'm worth delicious cement consensus we mostly do secure Yanni's we also build security tools mostly automated analysis tools I don't know that that my story of getting you to do exciting enough right now yeah I think I've been acting for most of my life and I found it here a while ago late at 2060 and I have been breaking smart moments ever season yeah into any question see my tagging the end or throughout the session yeah if you if you have any any smart contract endings quantity please so probably everyone here knows their consensus you know we're pretty broad we do a lot of different things but without that anything that there's also get additional arm that's what this is Academy and a CD on one side we tried to get developers skilled and ready to be able to build using an ear of technology and we're also trying to get business leaders managers and you know lawyers and all the non-technical people to understand the technology enough to then the fight business opportunities it is as important as that we have really strong developers community that we also have traction in the business and that the companies understand how to use it is probably not necessary or cases that if you're in deification in the block dedication space and for whatever reason you work with enterprises 90% of the ideas you hear that they want to be locked in for it's honestly not a good use case so it's very important that they understand when this technology is relevant and what is it good for and I think it's part of our commitment and our value to the ecosystem also to help that happen and a little bit that's what we try to do in academy since everybody here is kind of a convener level just gonna say that well we have trainings online like Central's our developers actually it's a cool word that in front of October 30th we have this code but if you're also looking to get into the space like looking for a job you might be interested in certifications those are certifications that are issued by consensus there's mark on fresh developer at CDC and here's developer basically is mark on track and apps smart content developers just mark contracts and EVP is it here in business professional in case you're interested or anything to be for a job those could be think that you might be interested in and also like I've said we have here Gonzalo from and from diligence and diligence basically what they help you with and correct me if I explain it wrong on Halloween is they know developer startups companies and basically anyone who has it smart contract to you know feel safer when they are in the beignet that you know they will not make the news because somebody had them I guess that's one way to put it and luckily this consensus there is you know that people that have really looked into this and and and I would say that probably one of the bright some of the brightest minds in this aspect this is in this so you feel very confident votes Tammy got many things with regard to security correct so we're gonna go a little bit about some code recommendations we're going to talk a little bit about some of the common attacks that you might run into in some of simple ways or a little bit of simple ways to address it and I guess most of you have ever made uh if you know if you're curious you have already made especially if you're you know familiar with this but we're gonna see how that pack of the DAO happened and so you can understand how at the bottom we're going to run the code so you can kind of see what actually what what is in problem or what happened there at one of the most renowned attacks I have in this base so a point otherwise I'll bore you them us basically when you're in something important that you understand is that this my concept of the N is code and it is compiled to bytecode which is what the etherium virtual machine understands and runs and ideally we're trying to make that code as secure as possible and if you really really want to get into the to the security level understanding honestly some people are actually especially for gas optimization they're actually working out the bytecode level so they understand the byte codes and actually at the end they work with the bytecode so if you're really into this eventually the next step or the next frontier for you is to actually be able to get to understand what's happening on the byte code level and actually try to optimize there for security not necessarily is the only thing or the most important thing but it is important that our gas that you consider because sometimes there's that level even just like rearranging things on this my contracting company so the important thing that I wanted to get started for the people who are new is that at the end a contract in the theorem is is just another account that that it's created by a transaction and basically the code is stored there so there's two types of accounts you have you externally own debates Macy's managed by the private key that as a user you hold and basically you are the one who wants to make the decisions however the contract accounts are governed and ruled by the code so they only will do what the code says that's it that's why you cannot change you cannot you can trust of code that is not there because you know that you will only do what it says it does and you could also trust this the fact it has its ups and downs that that no one can change it a one funny story of not funny sorry but one of the things when working with the the people were training them and how to to get the first smart contracts everybody or not everything most of everybody lots of the students forget to get the function to get the money out of the contract you will not use don't believe how making people forget that because everyone's used to that money just ends in the bank you know they don't think that that's the mindset of changing the mindset of how this works it's actually more challenging than people expect so you have no idea how many contracts are out there that have either locked because somebody forgot to have to make the function to get the money out right so it's important that and we'll see that when you actually try to runs here the felt fast which is kind of was something we heard a lot with web development in in agile and everything not necessarily his approach for smart contract is actually not enough the opposite but it's important that you are careful what are you doing so everything jumps from the point of your execution is you know the code is just taking by the IBM from the state from the town the input data comes in different section oh that is run based on whatever the function assessed and then at the end of the state the account be either to store it or whatever information that is in its next updated you know that's that's the logic of it and if we're thinking that if something goes wrong you know then you know that the state is regarded and that's important because we're gonna see one of the attacks where basically that's what you enforce to happen so that the whatever function you're trying to run never ends or never gets to the finalization period point so it's always regarded and then you kind of a have a denial of service kind of them as you know from those of you uses further for the new people there's smart contract has different spaces or different scope for barbels and what we use what we do with that and how to use them but also where we store them and the the point of view or from the point of view of the the space of storage or buddy knows that that's very expensive under maintenance you know you need to optimize as much as you can for that so there's there's like the temporary memory that's the memory of the stack that basically you can have variables that you will only be using while your code is running but then there will not be there that will not be stored there will not be saved and there of course whatever you need important we just say variables should be a mess relative memory should be on the on the on the permanent memory of this so that store there and you don't lose that information probably the only cases where you want to have something that is usually memory you want to store this if you have a very big array and you you know you know you cannot look through it infinitely because you have the gas limitation so you may run a store the last position of the array so the next time you run and you don't start from here because otherwise never look through the entire range so those are kind of things that you may want to think about when you're coding and that information that you're gonna need it for them whatever next goal you make that contract should be in the storage or in the permanent memory otherwise you know you for example in the case of your a you'll never look through the entire array because you'll start from what you initiate and initialize it in one and we'll just go until you run out of gas so it's very important to take those into account and as you know if theorem has a balanced model not as that UT excel as a Bitcoin so basically you know you it's much simpler for a lot of different things and getting like your balance and everything it's a simpler process is just basically a field a data field and in the structure rather than a completion of all the Bitcoin addresses and everything and adding them up and all that so it's very simple to use it and simplifies a lot of things however you know it does not allow serialization like a lot of transaction to follow like the UTS model does now so a times as well it's frozen comes but so basically that's why it's important that you know in transaction fees you have to make sure that the previous lectures are finished you're going to start it otherwise you know you're not going to have it all right a little bit of a movie so that I just wanted to make sure that we've got some basic concepts out there so as I was saying very important that you have to understand that the code you're like in this environment there's a high dose of failure and not only from the point of view of security which we all know but for everything if for whatever reason you know you need to update or change the code of the smart contract if you have not really thought about they how do you gonna migrate data or how you're gonna manage the data from the beginning it is up it could be a very big pain to make that change so thinking about it's very hard and sometimes when you're thinking about what here's my contract we'll do that sometimes you don't even know if things are going to evolve how you actually what all you're gonna need in the future so it's very important that you want really really take the time take your time to think what is my contract might be doing and also maybe if you want to start small and then grow it because if not you know you may run into some problem that the change can you can make maybe you get into a lot of trouble or like even need to like issues with potential users they have because you have to stop or something the fact that they're immutable is good because we have to trust and you have that but it also implies a challenge that you cannot you know I'll just try this if it doesn't work on this fix it or you know like I'll just try to fix it one time the important thing that I was saying you fail fast is not the approach and you need to think very carefully how you gonna address this that I guess is why we have services I think bugs are inevitable and and they're always mom and they might be there I mean I always say like you know if the doubt thing happens you know anyone can make a mistake so it's very important that you are aware of this and you're not afraid to to to to to to be open to testing it with others to have it their use you know external party services to audit your code for example I for example diligence or anything to run tools that you have their formal verification you know it's still happening you know some people there's new tools obviously I think it's a beautiful form of verification out there there there are few LeDoux's out there that are coming still is an ongoing thing like everything in the space you have any any give me we textile which is the name of the suite of food there's also like this evolving digital static analysis they cluster people they all were invented just like they doing the tradable beats ecosystem but it's basically the same thing difficult they receive all the engines so you shouldn't use them I didn't know that that's the only Texas easier to use so for people who are just starting devotees my conference you hardly ate util at all I'm using this would be nice also working on that I thought you like questions you get us and I guess I don't know other things that because that it's dance life so actually will help you like some new vulnerabilities identified and added to that W at this yet they will let you know where does it check for the human abilities that are compound there's a registry of all the doesn't exist so they check about that it's a new thing makes it to that list they add it and then you'll go directly to that and they use also like elected so that be able to scan muttering in the main mana swc become the Rico that holds all the identified vulnerabilities ship another important thing and I usually run into this you know do you need to make your code or try to keep your code as simple as possible and usually it's for examples it's good to start with baby steps and a lot of thing for example there's this was this person that were trying again it was more of a permission then well in New York real estate is a big thing and and there's a lot of permissions and documents that go back and forth a lot of making a lot of different parties so they were trained so that you can use block two for this makes perfect sense and finally does however basically what we said is that yeah but don't start with trying to get the whole work thrilling on its my contract or everything a lot of locking because you know it changes even change a lot you can change and on something so right now I start just by you know figuring out a way how to stamp or how to make sure that someone could verify that the document is valid and nobody has changes but you know don't try to get the workflow yet until you really get tested and you know that it works and you know that nuts gonna change because if you want to get you know government's on board you really want that you don't know what they're gonna request to you up in advance so first have it running get it there and then you know figured out what becomes actually transaction on reparative that doesn't change and then try to go try to go from there so it's important that you also think those into account important thing is as you guys know a lot of the things we do is important contracts or use contracts that are consistent that exists out there and they're they're safe there's some that are saved and you can trust because there's the people that are behind them however not necessarily everything out there is safe so it's very important that if you're working with an external contract you really pay attention to it and you really understand what it does you know how to tie you know all the dependencies have other mantras that you use especially if you know that you bought one contract in importance imports a lot that it works on everything so you really have to check everything that it's related to but because you never know if there's something that not necessarily it's a you know with a bad intention but you know maybe does someone's not relative to some of the contracts that you know big dumb person which is just not really that diligent with it and and just you know forgot to check something or to change something or just integrating some constant so it's very important that you take into account that yes exactly is I think it's yeah I think they know we also mentioned that on the compiler you know it changes everything specially does you know I mean so that it is still when there's no one yeah right so it's it's important that you take into account everything there and [Music] so now let's get a little bit more about those recommendations about the code a few things so some codes that we're gonna see them you know like basic mistakes that people make is you know how index executed there's there's it's important in the Orden of how things happen so the last thing that you will not that you want to do in the code is to send money you first need to make all the change well first check all the conditions is very important that you first check conditions so then you know that everything's correct at sea no normal programming then effect all the state variables that need to be changed because and this is what we're gonna see we enter the attack happens when you know I first sent you the money and then I take your balance in that sphere in that small period of time the fallback function kicks in and you know gets all the all the all the hacking and so it's very important that you always try to remember prior to prior to live to do everything that implies an external thing of your contract for the last everything that is internal to a contract should happen first and it's very important that you always make that you know your every day been abroad doing every day you know like don't forget to do that then you also teach another interesting thing is that if you have a folder that you check that you know whatever it's coming in with when it's golden he doesn't have any strange data on it so you get out of that small require there just to make sure that you know there's nothing strange coming in through your contract for the fall back in four tenets of there was mentioned you know changes happen in solidity very often like new words get deprecated and you would save us it's impossible to know exactly what will happen in the future but as much as you can try to work with the most reliable and up-to-date version of everything because they're introducing changes quite often but those changes are really important and as much as possible try to always work with almost latest and most stable version of whatever is out there especially with a co and just like he was saying is very important that you fix neither to a specific version even if you could put like anything from here and above usually that won't work then it's better if you fix it and you live it fixed so that you never get the chance that some words deprecated or something could be done in a different way because you never know every time you pick something you wrote something somewhere else so you never know what will what other back door will be open one with those one so it's very important that you always at least as much as possible try to know what you're facing and or challenges that you might need brought to you too so we're just gonna explain a little bit based on that light you'll be under the attack I know that this is fun let me see how well can do this but just I'm just going to quickly show to be so smart to you simple smart contracts just to show like the delicious and the vulnerable contractor yes there's nothing really complicated here for those of the quarry also new I don't think you're gonna have any issues understanding it and basically this is just a contract that just gets money and you know it will give you back one ether at a time that's that's all it does that's nothing there's just two functions well that's basically the deposit that you will just get much one heater or more yes yeah good idea thank you [Music] all right I think that's better so basically just gets one ether or more that's it nothing else is just for the purpose of the exercise there's the function that picks the money out and this what we're saying the issue that we have here is that your first kind of ascending the money and then affecting the variable this thing so my balance is like okay I'm going to give you five so I first give you five and then I go ahead and down and up on the ledger so that's that's the you should have a see that this mother chasm that you just have you know a function just to get balance so that's what you know that the the vulnerable contract after we enter this you know then the militia demolicious come truck honestly the only thing I'm having is as probably you'll know or most of you probably know you can Kurtis an object-oriented programming language so basically all I'm saying is just I'm just creating the DOS inherit and everything from the contract and I'm just passing it the address of the contract that I want to attack because I have that public address and you know you can import it there really depends on how you do it base is there and then you just have everything and the important thing here that sort is if you see I have a whole back function and therefore that function is just checking if the contract has money that's one thing but with one be fair reward that's a mean it does he just asked it calls the function will draw again that what the fallback function is doing here right rather than being just an empty thing where you're just you know just have it there just in case for whatever is something I'm saying or something now I have actually a piece of code that would run with this function is 4 right and basically the structure is similar so because the internet connection was a little bit bad I just want to take it and your wrists so here's basically this is the code of the Cinco I'm not really gonna make it that big as long as you've seen it bodis trust me it's the same thing and so basically I have the two contract employee all right everybody knows where it's here I figured yes I know there's some people there's you so basically all I'm gonna do is like let's say this poor guy over here it's been a deposit and eat here right so I deposit to the wall of a contract right so we get the balance balance oh yeah everything that doesn't other know if it meant bigger words it has ten 1099 that's what he cast right if you get if I get check the balance of the malicious concert you just has plenty to so you only think that right now if I if I just want to get it up I just like I even the first we contract the first thing that I need to do is that I need to get this malicious contract in the mapping in the contra that I want to attack right so the first transaction that actually happened it was this contract deposited one eat in the vulnerable contract so that it is in the in the main thing of people that you withdraw money because if you read the code you can see that you know if you're there you're able to withdraw money that's the only thing that the previous step that happened there right so now the only thing I have to do I know that this is the attackers address withdrawal and if you see takes some time because it's just it's got it's just running and if we just check this balance here you see now losing not ten you just have the ninety nine nine nine nine nine nine because I took all the technique out if I just check this contract here you see doesn't happen we have 32 but the code says only to take one and then the money why because what's happening is that at the time that they send me the money in the room in there in the malicious contract the whole back function kicks in so it calls the function again so the function sends another month call the function again and it just stays there also the condition is is out which is when you don't have one E that's why verse 9 999 there so that's it we envision C attack in something similar to this is what happened with the Dow and and is something that is not really hard to employ it's just as we were explaining before is just a matter of how you affect everything so whatever you're doing externally to your contract should always be the last thing that the function should do no after any uncertainty there but basically before Nia or is it us that's there another kind of a common attack how many of you are familiar with the TX origin attack okay as soon as hats off gonna go into more into it basically there's how many of you are familiar with the MSG thought center instruction or keyboard or cable so MSG Center basically just gives you the address of whoever is giving it's interacting with your contract so whoever sent the transaction whether whether that's a contract or a person and I guess so as you guys know what happens a lot in the space is that you actually have some person that sends something to a contract and that contract may call someone so for whatever reason the third contract or the second contract in this equation wants to know because you are going to send money and you don't want to send it back to the to the first contract directly to the user right to avoid gas and a lot of for the top reasons for that you use the X origin so you know what which is the address that it started the whole transaction in itself right so that's handy in that case so you've been withdraw or like thinking money out it would be happy so you don't have to pay for whatever reason anyone who's in the middle right or like or have a lot of transaction happening from everything that is in the middle however it also could work to impersonate someone and what happens is that let's say what's your name till you tease me so let's say I want just to do personate him so what I would figure down and then take that her name is Jason Jason so the book the contract he wants to really interact with this JC's so what happens is that I figured out a way to trick him to think that I haven't a C's contract I don't know you know the fishing and whatever it looks like it or something anything is wallet or you know exchange or whatever thing I don't know I just figured out a way to trick to trick it so you'll send the transaction to me and what I will do is then then I will send it to DC right but you because he uses TX origin then he's going to think that is actually him who's getting the money for whatever reason depending on how the code is I would be able to perhaps do something that I'm not supposed to do maybe not necessarily still funds because still he's just gonna refund that TX urgent obvious but I not be able to break something or to may be getting then the follow-up function of do something there that you know I don't want that this is not me now that's that's the hard thing to wear your coat is hopefully is that people could be really clever and figured out how to attack it definitely two more together simple investment so that's a little bit about its origin so I'm not saying not to use it but you have to be careful for what you use it so did so that you are not really opening the door for someone to if they manage to make this straight to you to do to try to do something to your code or to take advantage of anything that is in your contract and so I so another thing that could happen is is similar which is kind of a denial of service kind of a thing that's the best name of it but good basically what happens is left similar then say this is an example of let's say I have a magazine and you subscribe to it and monthly or for whatever reason you you pay me on a recurring basis but I also have my function value ref on fees for something Ellen for fun everybody you know I'm shutting it down I'm refunding everybody because I'm changing the code to a new code people just for them to be happy I'll just give them back the money makers because I'm going to change this my contract and have a new one I don't know whatever United figured our photo so that these cases is like really hard to find a specific one but let's say that I have a function when you through the an array of all my the people that has been subscribed and to refund everyone so basically what I could do here is that I could get rather than someone's like an externally on account address there I could get a contract and what happens is that when this person is like okay I'll give you back your fee and I your address out but I actually do that here how to pull back and just get it there so that this this function never finishes because I just keep gives you the trap I'm not earning money out of it I'm not very good the only thing I'm doing is just to break your system there's not necessarily to get any any economical game for me but I just find a way to break your system and they think that happens is basically that so because it will not happen or I do put a condition for example like one equals zero that's all you will always be both require one equals zero that's always full so he's got to turn back give back an error so this thing is gonna revert so you're never gonna be able to pop my address out of the array and you're never gonna be able to through the entire array I didn't get any money I didn't got anything out of it just you know maybe cost you a lot of pain with your reducers because of course if you don't have any other functions any other way to refund the users you're not going to be able to respond them right so this is why I all say it's very important that you you have to think about all the things that could go wrong in again it's as simple as first think that not herself affect everything internally in your contract then do whatever you do an externally you know that could you know not necessarily solve everything but probably will help you a lot so how do you face this vulnerabilities like you said there's ESWC you director this which you know there you could go it's very good very uh it's you have examples of go there you have examples of solutions there so I definitely some resort that you should check and that you should you know they have miss it every now and then because it's so stated but there's also called design patterns there's things that you know people try to put in place so that you kind of a if you implement those in your code you're I'm not gonna say you're bulletproof but at least you know that you're prepared to face some of the most common things that until somebody more much more smarter comments in and finds another backdoor we're gonna be able to at least protect yourself so I'm just not I'm not gonna go through all of them this is quite simple and evening you know some meet you for you might be obvious we have this expertise it is very important that you try to take advantage of the modifiers and have permissioning to we do what because if not if you just have it public or if you have it or you didn't put private or you don't have anything you know anyone could execute something and again sometimes people forget how different it is to work on for you guys early name like second nature now but for all their developers that are more useful on premises or all the kind of things it's it's a shift in their mindset so it's very important that you always also forget don't forget about these kind of things so I used about a I've got that all the modifiers to use when I was pool has permission to do what on your contract then I'm kind of over it saying and very important that you know you do you know who can explain the difference between require and assert for conditions when do use one yes what difference is that assert will burn or will take hold a gazetteer out there require will give you back in case of failure will give you back there may be gaps camp that's custard yes sort of should never ever grow time yeah that's true so usually you first require and you leave a cert for the blast piece of it cases usually that's an important ordering that you have for having habits like whatever if we extreme or everything shoes that you know it's so much worse I think that might happen that could break or something or you didn't fall into that the recent 3G service for certain variants right the states thank you and then for once happening right so like if you let's say you don't want the balance of your smart metric to ever be won the way you designed it should never be below one a third-rate the wizard is evil impede solidity that he actually uses a different occup right and even valid all coded as opposed to that the reverbnation now what this allows that we like publication to be like from from consensus diligence or from the trail of bits you should use the consistent allegiance works but from other them work the same way you can use the assert indicia for those tools to be able to see if anything is violated in your smart contract right III do think that the solidity team link also has the SMT checker updated right now to be able to audit generate these these assertion violations based on your code alone but yeah you can add these yourself and then run the tools and make sure that none of these assertions are violated with the help of like automated for example I know that some of the people that is amazed icos or something like something something could be hackers I think they had like a searchlight if there's a section is over ten percent of the volume stop so what's the benefit of burning the gas for assurance where is it is it to the extremity of it you want to there may be like a murine said behind that bright ahead the way they're used today most least that they should never be treated so like that's likely where it is better right like the beginning that they the yonk oh that actually returns the remaining gas to the user it didn't exist range them to the guy who played the transaction that didn't exist so this is all yet when the game into existence it doesn't make much sense to use this unless you want to and these are again these are meant to be in various stuff that will not happen tempered by specification so you're basically specifying you you're basically translating the intent into solution like you're saying this shoe and never ever anything does everything to stop that's when those automated tools that I said you verify that your assumption detail sure we are certain like originally should be above this I know that like I said some I feel conscious my contracts from the changes they did to Jack White was that if there were two transaction to where like about 5% of the total cooking supply or a few things like a great strange thing that should not have been an illegal normal or stasis to have that stop so somewhat acceptable because this may be more confusing 15 it's not I don't know you tell me but like one good example like the B word versus a certain discussion is safe left by opens up you guys know what safe methods the library that actually checks that there are older poles and and they're frozen would not do not have been trained it's a safe way to do math in basically you was able to be the certs and what this meant even opens up his head was that if it's an assert each it never happened so your code should already make sure that overflows do not happen however people were not people are using it to protect themselves from one another and each moon death right so opens up in Green Road safe back because now it's a yeah let's eat Yomi yeah yeah yeah sure I guess difference they look like they're nice license I don't and maybe all stop execution so they have no Kumar's it was all required statements used to record all folks so like they actually returned to guess a message yeah yes it's not accept somebody yeah you could put like a not something but every condition do you just want to know I just put it out there yeah this might be like earlier coda in the beginning during choir a statement Steven even allow you to put messages and now they both used to refer out but at least in the defense before stopping execution so that but it's important that I mean that you always try to make sure I will require with its statement or serve depending on you know kind of a thing that you always check for behavior of your contract you always states that does nothing but at the end that's the most important thing that your country behaves as you expected that it will behave then well like I said basically this is just all the check affects interaction which is just you know everything internal than external and basically you know of daily requirements state variables and they're bloody rebels externals or payments that will save you a lot of trouble it's very simple to actually remember don't forget then there's also times where you may want your contract to stop running I like for example like I will say no this guy's on the ice do they figured out that you know their beam Act they managed to stop that's not good but you know you may never know something else will comment so you know I want this to stop Oh in my contract for a time this is all right so you could have those and they're not that difficult just you know a boolean variable basically that only specific person would be perfect up with a conditioning to do animals will open or close that door and have it there so that you use make sure but you we have this emergency stuff in case of the cavity or you know you can find the outlet also buddy's figuring out a way to take money out you know not every thought happenings happening right now as I see the money going down I want to stop this or something right very important that if you think you know all those kinds of things and like I said this is just like thinking from this beginning it's like do I want it you I don't want it you know it's very important that you stop to think about your contract what features you want to have your contract as once it's out there you know it's pretty not that simple to make changes for it and sorry do you think I've been like that it's tough flag throughout your code like you do checks against that or yeah basically but basically if you see at the end it's like emergency withdrawal in this specific case when you just happens like yeah your contract has to be stopped and for whatever you said like somebody's taking Tony Ali's not safe so you tell like hey it's all safe I used to take the money out of my mouth the term stuff so it's tough you stop it and then you take all the funds out you know so yes you put it there and under the circumstances that you stopped that you you check that the variable is stopped or like if it is before any payments you may want to and it is really whether you do it or not it will depend on you know how critical it is or how important it is but you can always have plaques that could allow you to stop something or even to put timers of things here's the stuff go no go we also have a timer for example so that something doesn't happen you know 5% though you can know you can know withdrawal or 5% if not in 24 hours kind of a thing you know for example you can have something therefore that you usually have like a modifier in easily opens ugly has like very sender libraries do this or just contracts a kink in there from there I'm talking the line bottoms on top of them if you search for open that mean Google like they have a bunch of stuff including their framework like this they have an OS and they have like that normal like symmetry framework that it just has a lot of reusable components it plugin click then you know like a variable contract something basically what you have there is just you not a proxy contract is the only thing is just being connecting you between data and the logic of the contract sometimes so far in this accessible first basically what you would just have here is that you know you have left fold the address of the latest version of the contract that you want to use for whatever things that you're running or whatever process is there that you want to have and basically this contract the only thing that it does is just holding the data right and so basically if you would need it to change because the look usage the logic of a company deployed a new version of my contract let's say in that new version you added the stock for example right for whatever reason so you would come here you would update the you'll tell it now whatever thing that happens you have to interact with this new contract that I deploy so you kind of a given the new actors point you know that it's like I love working with this contract now you're talking about a contract so that contract that's whatever we see you no longer want to use you know you can disable it you can tell this trumpeter if you just even there whatever you want to do but now important thing and this is kind of a wait also they kind of a split a little bit of like the data and the maybe the logic the business logic of your application and that I bought the same fastball internal storage in fiction when I go to the drink does the finest they pass Colorado mark thanks but just to make it really kind of wrote it a little bit I know there and this is more about like recommendation thinks it's like you guys know like I said that storage is important everything is by 32 word and all that so even if doesn't seem like a big difference or like something that you would say like if you already how do you order your your state variables map because if you're able to pack them in 32 in back to 32 that everything you make a more optimal use of space and if you actually use this calendar gas consumption so another common recommendation there is you know when you have your state variables and you have everything there you know for whatever we should you figured out a way how to better arrange them it could be important depending on a lot of the circumstances of what your doctor does or what you're doing if it's a factory or different things out there it could be a 32 bits yeah for example here plus a 16 16 to 32 and 16 won't happen is that or and become Robin Sullivan is that basically you're not gonna there's gonna be empty spaces in the middle because the word is 32 so 32 is another 16 now I need to put 3200 I didn't have space or use another I user no space in the stack or now I got 16 so there's gonna be empty spaces so if you put 16 16 they're gonna be better packs but it still looks dumb but the way this all you do brother works is by reading from top to bottom my whatever whatever it is he'll always read the stuff we talked about and in the reason why these subsets of this this way you would read 60 bytes and he wouldn't tribute in to us and then the way in words this weighs exactly because there are stars slots that get used right so this would be started slot number zero in now he tries to ride to the second slot because obviously if each slot is 32 bytes is 32 bytes won't feed into the first one now if you do it like this this little mother will look this in the first part of the 32 bytes and Athena's zeroes slot right and then he still has like another cc bikes addressable light and then it takes these just like looks coming from the VA kind of yeah I was thinking this the C compiler actually does like actually seen us like packing optimization and in your favorite kind of stuff its validity how do you mean yeah this is this impacts it up so like actually means like everything is 32 bytes yeah but it exactly what it does for you if you put this and see you kind of the patient in us for the sole superpower things without sure they're busy in this it's complicated as I could not only get it with my trophies gets tricky fussing reason why is that so because of this olivianelson negatives rate in each of these slots they are shared in between contracts so like if solidity is there not like you see reason like a clear ruling the clear rule as to how solidity does that time vacuum and in right now he's from top to bottom maybe with a better solution people disgust me delegates it's just a ATP's back to the trade language like you can do it a million ways with like this is this is how he doesn't like if you'd married from this contract the layup storage of the narrative contract will be exactly the same right so I assume Italy likes like we randomly packed stuff in different places when you leave the transactions for example like sending one each is 21 that's a cost of the transaction but it's not because cost is for more than one it's just like transaction 21,000 guys because like that's dead here this this might I don't know this you're riding it even this might be wrong in the sense that this may be what I may have bring me this and what I meant here it was that a lie execution I mean like when you guys to be executed at least once first yeah because it doesn't make much sense to talk about execution classic you just point [Applause]