Smart Contract Security Audit: Best Practices for Secure Blockchain Development 2024

This code shows how to prevent common vulnerabilities using OpenZeppelin's security libraries. Notice the multiple layers of protection.

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.19;

import "@openzeppelin/contracts/security/ReentrancyGuard.sol";
import "@openzeppelin/contracts/access/AccessControl.sol";
import "@openzeppelin/contracts/security/Pausable.sol";
import "@openzeppelin/contracts/utils/math/SafeMath.sol";

contract SecureVault is ReentrancyGuard, AccessControl, Pausable {
    using SafeMath for uint256;
    
    // Role definitions
    bytes32 public constant ADMIN_ROLE = keccak256("ADMIN_ROLE");
    bytes32 public constant OPERATOR_ROLE = keccak256("OPERATOR_ROLE");
    
    // State variables
    mapping(address => uint256) private balances;
    uint256 private totalDeposits;
    
    // Events
    event Deposit(address indexed user, uint256 amount);
    event Withdrawal(address indexed user, uint256 amount);
    event EmergencyPause(address indexed admin);
    
    constructor() {
        _grantRole(DEFAULT_ADMIN_ROLE, msg.sender);
        _grantRole(ADMIN_ROLE, msg.sender);
    }
    
    /**
     * @dev Deposit funds with reentrancy protection
     * @notice Implements Checks-Effects-Interactions pattern
     */
    function deposit() external payable nonReentrant whenNotPaused {
        require(msg.value > 0, "Deposit amount must be greater than 0");
        
        // Checks: Validate input
        require(msg.value <= 100 ether, "Deposit limit exceeded");
        
        // Effects: Update state before external calls
        balances[msg.sender] = balances[msg.sender].add(msg.value);
        totalDeposits = totalDeposits.add(msg.value);
        
        // Interactions: Emit event (no external calls)
        emit Deposit(msg.sender, msg.value);
    }
    
    /**
     * @dev Withdraw funds with multiple security checks
     * @param amount Amount to withdraw
     */
    function withdraw(uint256 amount) external nonReentrant whenNotPaused {
        require(amount > 0, "Withdrawal amount must be greater than 0");
        require(balances[msg.sender] >= amount, "Insufficient balance");
        
        // Additional security checks
        require(amount <= 50 ether, "Withdrawal limit exceeded");
        require(address(this).balance >= amount, "Insufficient contract balance");
        
        // Effects: Update state before external calls
        balances[msg.sender] = balances[msg.sender].sub(amount);
        totalDeposits = totalDeposits.sub(amount);
        
        // Interactions: External call (protected by reentrancy guard)
        (bool success, ) = payable(msg.sender).call{value: amount}("");
        require(success, "Withdrawal failed");
        
        emit Withdrawal(msg.sender, amount);
    }
    
    /**
     * @dev Emergency pause function (admin only)
     */
    function emergencyPause() external onlyRole(ADMIN_ROLE) {
        _pause();
        emit EmergencyPause(msg.sender);
    }
    
    /**
     * @dev Emergency unpause function (admin only)
     */
    function emergencyUnpause() external onlyRole(ADMIN_ROLE) {
        _unpause();
    }
    
    /**
     * @dev Get user balance
     * @param user User address
     * @return User's balance
     */
    function getBalance(address user) external view returns (uint256) {
        return balances[user];
    }
    
    /**
     * @dev Get total deposits
     * @return Total amount deposited
     */
    function getTotalDeposits() external view returns (uint256) {
        return totalDeposits;
    }
    
    /**
     * @dev Receive function for direct ETH transfers
     */
    receive() external payable {
        revert("Use deposit() function instead");
    }
    
    /**
     * @dev Fallback function
     */
    fallback() external payable {
        revert("Function not found");
    }
}