# Learn How to Secure Your Code As You Write It by Manuel Garcia

- Channel: [Devcon](https://streameth.org/devcon)
- Date: 2020-10-09
- Duration: 19:40
- Topics: blockchain, smart contracts, distributed ledger, ethereum
- Watch: https://streameth.org/watch/yt-JDyewm3skew
- YouTube: https://www.youtube.com/watch?v=JDyewm3skew

## Description

Visit the https://archive.devcon.org/ to gain access to the entire library of Devcon talks with the ease of filtering, playlists, personalized suggestions, decentralized access on IPFS and more.
https://archive.devcon.org/archive/watch/5/learn-how-to-secure-your-code-as-you-write-it

The Ethereum Virtual Machine and the Solidity language are not trivial components to build with. When you code, you need to consider many more things than with other traditional languages. Things like execution cost, storage and the most importantly: Security.
Also, using a code style guide is a must. It will help any current programmer in a project adhere to the rules pre-established by the team, and enormously help a newcomer avoid some undesired writing styles, impacting on code review quality and speed.
I will introduce you to one of the most used open source linters in the ethereum ecosystem: Solhint.
Solhint allows for detecting syntax-related security code vulnerabilities. Covering a wide range of validation rules, the tool also enables developers to add new ones, while complying with the Solidity style guide and granting 2x–4x boost in performance.
By attending to this workshop you will go through the journey of using Solhint. From integrating it to your preferred IDE all the way down to  get the most out of its functionality.
I will close the workshop sharing best practices that are hard to port - and are still yet to be implemented into Solhint.

Speaker(s): Manuel Garcia
Skill level: Beginner
Track: Developer Infrastructure
Keywords: technical

Follow us: https://twitter.com/efdevcon, https://twitter.com/ethereum
Learn more about devcon: https://www.devcon.org/
Learn more about ethereum: https://ethereum.org/ 

Devcon is the Ethereum conference for developers, researchers, thinkers, and makers. 
Devcon 5 was held in Osaka, Japan on Oct 8 - 11, 2019.
Devcon is organized and presented by the Ethereum Foundation, with the support of our sponsors. To find out more, please visit https://ethereum.foundation/

## Transcript

[Applause] okay guys good morning I was less then we go to therapy planting a woman here with a working party to money to pocket that stuff I heard that it was quite travelling that people went to bed quite late so thank you very much for coming to this talk and we didn't reduce myself first I am Anna Garcia from Argentina I work at for a fireman shop help other people we build things for other people to deliver this talk will be specific tools to help developers to improve two things one is the quality of the code and most importantly the education of how to learn why you do it the agenda will be to talk about what is an interest as an introduction and why should we care about it some issues that many developers run into this tool can help some rules and how we can categorize them then go into a specific tool that is also linked to learn a little bit about it and how to use it and extend a time also what's next with this tool first of all us to set up the grounds many of you are developers many of you probably develop in other languages before solidity and that you have gradually they do went into solidity probably spend a lot of time that could have been spent finding features building delivering work with tooling the body I've heard that some guys from Vito they created a stack trace recently they are not silly so but also truffle and insanity butter more advanced debugger I remember what you did from three that the technique from others said that he was going to pay I don't know how much to anybody who can build a debugger well took a couple of years so winter is targeted to analyze a static code and I saw the structure by deleting the text outline a grammar and from that bloom are being able to analyze many many many things so this what it does is start enjoying a white box testing as it is considered some practices and a total like Soviet will allow you as specifically to go through all the structure of this one being able to analyze a specific semantics of the language and run it through a bottle health rules and see what kind of work what work in sales you can be family and all of these of course without having to go to compile the related is mark contracts which is much more time-consuming and we don't you know it's not going to okay some benefits from using a tool like this are you get to increase the productivity you get to the Livermore things get much it done as a team you can share some decisions about what you care what you don't care and if it is not included let's build it let's extend it this is more you get code that is more readable not only for you for the team but also given that 95% of the code is open source and out there when we do open source well we tend to do things right I might have seen that many many times people becoming great developers when they started working on open source you get to have code reviews even though many things just appear there before getting that they are to be reviewed that of course mentor life cycles already very much much faster and one of the very important things is that you might be many developers in the team but the code is like coming from one team you don't hear from who the course is the same following the same standards that is about coding also it you get to know very early be able to identify problematic patterns instead of work in a few weeks and then identifying many files and you know the rest and most importantly to think here at least I find more importantly because I've been using inter since Java but in the days we don't we don't go to the documentation to over and with a litter that can give you a feedback on what you're doing wrong you can get very easy to the documentation of what you're doing wrong you learn and you don't have to run run again into this this problem so by having this feedback children and you learn a lot some of the issues that at least I think that many developers run into I they are at least well they won $25 to five when you don't have convictions you give to have a code that is quite different for each other for all the files the developers people get very angry it's a jr. what is he doing this low reliability and efficiency these girls know much for the code style but also for some parts that on effect are not effective as an execution complexity that can be completely avoidable from the beginning and then say okay I didn't know about this bunch of heart disease I didn't know about this bunch of security vulnerabilities that are already documented and explain it how to be avoided I know intentionally hundreds of the code but well if I cut somebody watching there and if it is a robot that tells me that I don't have to spend time from other quarters article reviews take too long because you have reviewers each word you're saying no I like things to be done this way or come on this is an issue that is very well known or not you're violating a best practice in attending it has been identified early [Music] what rules is tool has so far by the way this tool has like two years now around two years yeah so we can categorize them in three one-hour style guides second or best practices that are this first tool while the first is more oriented to solidity the second is like any programming language the third our security some examples there's that okay it starts with spaces in an augmentation and many others Volcom best practices diplomatic complexity and use variables functions and security most importantly some very well-known and documented rule such as Brienne's we see nothing here when you call contracts are not written by yourself so yep I'm here okay we have some references they are consensus-builder guy a long time ago so that guy's was quite well documented and we were able to program those rules into this finger and the second one is it is tie guided by the image itself discrimination I want to show you some rules so if you go to the documentation you can see a lot of a lot of rules that are already implemented well there are quite quite many and some references this is greater if you have heard transistor written in text documentation we can go and program them and through an intern intern and when I say we is we it's completely open-source these recommended okay I will be getting back to this so this is about solving a tool that was built more than two years ago by a guy who was migrating form from Java to solidity and he found like a lack of these very basic tools he got into a parser of grammar person by some solidity drama that was build by Federico on another guy from our city well every discovery is priceless it increase increases the willingness and happiness of doing code reviews given that the reasons that I explained and shared earlier this is the sodium users will go to get absol in service it's not that much important how do you see season three we simply just install it and you have to initiate the config file from that specific project then you can add it to your tooling to bank are no packages like it's fixin to say ok run winter inside the cycles a continuous integration so we learnt only running in family but you also running the Nvidia and from there is configuration file is wide open previously it was more opinionated but we had some feedback it was like too noisy sometimes so some teams suggested to remove everything this thing was an open setting in our we by default we remove all the warning so you can go there and start selling inaudible the configurations are presets of rules to can have the rules by default are like none then you have recommended rules that when I show you the rules there was a comment we check with checks on which of the rules that are recommended the other ones that you can add manually also it had quite a big refactoring recently to allow plugins such as other leaders the first plug-in is pretty great here anvita allows you to extend with some other rules off some of placing three properties right now I put in both recommended to start when you start with these vices like what I'm doing I don't have any rules probably the future we will change this plugins and rules you can customize if you don't agree with the presets you can customize this to get different type of errors or different type of rules you can add more rules it's quite quite flexible how can you extend this and some other information there has a plug-in reference that you can follow and implement your own plugins and contribute back you can create rules it's just JavaScript files I can show you later and one important thing that the guys from Aragon we sent them a are Brett said okay it's very nice but we have many many projects so let's we have one definition because one team operating for many many projects and we created a concept of shared conflict which you create while the file and wishes published to NPM and there you go with some presents and in the future you can start your project and I would say and we use item to our present or know she's present [Music] it has integrations with many IT to piece some of them are kind of a pain so to do but it is evolving and well the core developers is use pins or sometimes it's a about the other ladies and it has been integrated by default in urban settling soon with a new version of traffic that allows plugins and that you will government optional in the fall packet it will be one to first clients to be installed by default we have been working with these guys for quite some months okay so let's see if I can do [Music] these are the contracts of project that we worked some time ago it's disinvest exchange based on the data options not what the workers the fight was all that was looking for a process and although these same points some time ago so the code is completely not the code that you have right now use now kabaah then you okay come to mean so I and you get an output like this but such as a yes in turn you can format the output so I can run like in somewhere here there the format table thanks for the size and you can see here contract by contract some time of the world the lines where this is happening of course that if you can integrate it with an ID you can't just jump into that the rules that you're breaking here from this rules you can go to the documentation learn about it you don't do it again and recycle recycle recycle until at least Union you get to know this set of rules here are some examples that I wish have been the presentation because we are not going to have time again these are JavaScript files I'm not very hard to to implement um I wanted to share this with you we applied for a Athena Foundation grant given that this is made with a lot of thought but we have to pay the salaries and we will be adding these features one of the things it's so separated from the CLI so if we have a library we can embed it in things like REM eat the rabbits team approach to us to do this and we need to do that it's coming to talk about the plug-in also some refactoring and very important to cut that out of it however this is nature's because if I perfect and I don't know what I did wrong I am loosing the opportunity it's real well improve the documentation a lot that is very important and sounds like it's like a branch pick that is will be extremely awesome to have meaningful output when you have a raw sword when you interact in the contract and more things that are requested by setting ok this will be our financial toughness [Applause]