# Smart Contracts: Coding Best Practices and Security Recommendations by ConsenSys Academy (Devcon5)

- Channel: [Devcon](https://streameth.org/devcon)
- Date: 2020-10-09
- Duration: 55:05
- Topics: Devcon 5 Day 1, Breakout Room B10, blockchain, smart contracts, distributed ledger, Science & Technology
- Watch: https://streameth.org/watch/yt-clbqEZcA0II
- YouTube: https://www.youtube.com/watch?v=clbqEZcA0II

## Transcript

[Applause] so how many of you would consider yourself you know insulating is my contract light because you're starting with it you're not you know first time to it you're Dukas get installed and you have coated a few things but you know you're still pretty new okay so I would hear that everybody else considers themselves to be intermediate or advanced level of security all right so I don't know how much of what I'm going to say perhaps I've already you already know about it so we could have more of a dialogue and you could end and you can have we're gonna have a room at the at the end of the session for some questions that's horrible feel so y equals hollow from diligences here because the morgan securom their everyday basis so if there's a question that i'm not able to address you'll push for being able to at least help me period Automator solve it so how many uh so how many of you are from our tough take in any class or anything in freight carrier or how many of you take purses or do you teach yourself how many of you take courses how many of you learn yourself most of these all right that's good alright how many of you they're like from github or rickles for people without that's mostly where people learn up from yeah if not work where do usually if you want to learn about doing where do you go to I'm sorry read the dog you read this back to the dogs yes I don't know come on once all right and ghosts our curiosity because we're always about hominid people here's consensus yeah we're always there all right so let's see we could get started guess on a favor Erma schools have actually helped give us out there for more time of Oregon this so considering that most of the audience says advance for each immediate I'll try to go maybe a little bit fast about about some of the topics also I don't know how well some of the code will be we will be able to be reading on the back so we'll see how that goes so we have more time for questions and answers or like concerns about audio address for focus security and maybe even some of the things tell you a little bit more about you know how audits are conducted for smart contracts all right so let me go back to you first of all welcome so I'll choose myself in all that Kinsella I choose himself so my name is Carlos I got involved in the blogging space and in 2014 my startup at that time and basically I was just you know trying to I was using become blocked into stamp documents because my startup were having a lot of documentation and using DocuSign didn't seem like something a start up with you so I started with it but to be honest I didn't really got like he didn't excited me that much then but I rhymed with here and that for me was really on my mind and he made me get into the space a little a little have been doing things in the space on so I joined consensus I think about in almost two years perhaps and I worked in the educational forum more about it later but also in this session moment introduced you to consult Adrianna can vegas-themed I'm worth deletion seaman consensus we mostly do securities we also build security tools mostly automated analysis that report I don't know that that my story of getting me to do exciting it up right now but yeah I think I've been acting for most of my life and I found you why let go late 2016 I have been breaking smart moments ever season yeah I'm here to answer any questions you might have in the end or throughout the session yeah if you if you have any any smartphone zarkanians quantity place to put them so that's probably everyone here knows their consensus you know we were pretty broad we do a lot of different things but without that in that there's also get additional arm that's what this is Academy and basically on one side we tried to get developers and skilled and ready to be able to build using engineer technology and we're also trying to get business leaders managers and you know lawyers and all the non-technical people to understand the technology enough to identify business opportunities it is as important as that we have a really strong developers community that we also have traction in the business and that the companies understand how to use it is probably not necessary your case is that if you're in the education in the blocked education space and for whatever reason you work with enterprises 90% of Big Ideas you hear that they want to get locked in for it's honestly not a good use case so it's very important that they understand when this technology is relevant and what is it good for and I think it's part of our commitment and or value to the ecosystem also to help that happen and a little bit that's what we try to do in academy since everybody here is kind of a communion level I'm just gonna say that well we have trainings online like sense holes our developers actually took over that October 30th we have this code but if you're also looking to get into the space like looking for a job you might be interested in certifications those are certifications that are issued by consensus there's mark on fresh developer at CDC and the fear of developer basically is mark on track and apps smartphone developers just and EVP is a hearing this is professional in get you're interested or anything or looking for a job those could be think that you might be interested in and also like I've said we have here Gonzalo from and from diligence and diligence basically what they help you with and correct me if I explain it wrong with Halloween is they both developer startups companies and basically anyone who has a smart contract to you know feel safer when they are in the beignet that you know they will not make the news because somebody happened I guess that's one way to put it and luckily this consensus there is you know that people that have really looked into this and and and I will say that probably one of the bright some of the brightest minds in this aspect this is in this team so you feel very confident folks have you got any regard to security correct so we're gonna go a little bit about some coat recommendations we're going to talk a little bit about some of the common attacks that you might run into in some of simple ways or a little bit of simple ways to to understand and I guess most of you have ever have made uh if you know if you're curious you have already made especially if you're you know familiar with this but we're gonna see how that pack of the DAO happened and so you can understand how it gone and we're going to run the code so you could kind of a see what actually what what is the problem or what happened there but one of the most renowned attacks I have in this base so as it's been otherwise I'll bore you to death us basically when you're something important that you understand is that this my concept of the N is code and is it is compiled to bytecode which is what the Imperium Virtual Machine understands and runs and ideally we're trying to make that code as secure as possible and if you really really want to get into the security level understanding honestly some people are actually especially for gasps optimization they actually work out the fight code level so they understand the byte codes and actually at the end they work with the byte code so if you're really into this eventually the next step or the next frontier for you is to actually be able to get to understand what's happening on the byte code level and actually try to optimize there for security not necessarily is the only thing or the most important thing but it is important that for gasps that you consider because sometimes there's like even just like rearranging things on this mark on track development so the important thing that I want you to get started for the people are new is that at the end a contract in the theorem is is just another account that that is created by a transaction and basically the code is store there so there's two types of accounts you have you have certainly known the big space is managed by the private key that as a user you hold and basically you are the one who wants to make the decisions however the contract accounts are governed and ruled by the code so they only will do what the code says that's it that's why you cannot change you cannot you can trust out code that is there because you know that you will only do what it says it does and you could also trust this the fact it has its ups and downs that that no one can change it a wonderful funny story of not fine sorry one of the things when were working with the people were training them and how to to get their first smart contracts everybody or not everything most of everybody lots of the students forget to get the function to get the money out of the contract you will not use ee-ha making people forget that because everyone's used to there's money just ants in the bank you know they don't think that that's the mindset of changing the mindset of how this works it's actually more challenging than people expect so you have no idea how many contracts are out there that have either locked because somebody forgot to have to make the function to get the money out right so it's important that and we'll see that when you actually try to runs here the felt fast which is kind of was something we heard a lot web development in agile and everything not necessarily this approach for smart contract is actually not another the opposite but it's important that you are careful what are you doing what you don't do so everything just from the point of view of execution is you know the code is just taken by the IBM from this day from the town they even with data comes to different section all that is broad based on whatever the function access and then at the end of the state via can't be either to store it or whatever information that Center is updated you know that's that's the logic of it and the important thing is that if something goes wrong you know then you know that the state is regarding and that's important because we're gonna see one of the attacks were basically that's what you enforce to happen so that the whatever function you're trying to run never ends or never gets to the finalization period point so it's always regarded and then you kind of a have a denial-of-service kind of of them as you know from those of uses for the for the new people there's Smart Pot truck has different spaces or different scope for variables and what we use what we do with that and how to use them but also where we store them and the the point of view or from the point of view of the the space and storage everybody knows that that's very expensive on the main name you know you need to optimize as much as you can for that so there there's like the temporary memory that's a memory in the stack that basically you can have variables that you will only be using while your code is running but then there would not be there that will not be stored that will not be saved and there of course whatever you need important we just state variables should be a pledge dollar commemorative should be on the on the permanent memory of the stuff so that store there and you don't lose that information probably the only cases where you want to have something that is usually memory you want to store this if you have a very big array and you know you cannot look through it infinitely because we have the gas limitation so you may not store the last position of the array so the next time you're running you don't start from zero because otherwise you'll never look through the entire range so those are kind of things that you may want to think about when you're coding and that information that you're gonna need it for them whatever next goal you make that contract should be in the storage or the permanent memory otherwise you know you for example in the case of your a you'll never look through the entire array because you'll start from what you need share initialize it in one and we'll just go until you run out of gas so it's very important to take and as you know aetherium has a balanced model not that's that UT Excel is a Bitcoin so basically you know you it's much simpler for a lot of these are the things and getting like your balance and everything's it's a simpler process is just basically a field a data field and in the structure rather than a compilation of all the Bitcoin addresses and everything and adding them up and all that so it's very simple to use and simplifies a lot of things however you know it does not allow serialization like a lot of transaction to follow like that UTS model does now so it does is well it's frozen comes but so basically that's why it's important that you know any transaction to you you have to make sure that the previous inspector that finished we're going to start it otherwise you know you're not going to have it here it's not a half all right a little bit of a quick answer that I just wanted to make sure that we've got some basic concepts out there so as I was saying very important that you have to understand that the code you're like in this environment there's a high cause of failure and not only from the point of view of security which we all know but for everything if for whatever reason you know you need to update or change the code of the smart contract if you have not really thought about they how do you gonna migrate data or how you're gonna manage the data from the beginning it is a it could be a very big pain to make that change so thinking about it's very hard and sometimes when you're thinking about what your final job will do cuz sometimes you don't even know if things are going to involve how you actually what all you're gonna need in the future so it's very important that you are really we take a take your time to think well there's my contract might be doing and also maybe if you want to start small and then growing because if not you know you may run into some problem that the change can you commit maybe you get into a lot of trouble or like event me to like issues with potential users they have because you have to stop or something the fact that they're immutable is good because we have to trust and you have that but it also implies a challenge that you can not you know I'll just try this if it doesn't work on this fix it or you know like I'll just try to fix this as in one time dan the important thing that I was saying you fail fast is not the approach and you need to think very carefully how you're gonna address this then I guess this is what we have some services I think bugs aren't enough inevitable and and they're always not and they might be there I mean I always say like you know if the thing happens you know anyone can make a mistake so it's very important that you are aware of this and you're not afraid to to to to to to be open to testing it with others to have it their use you know external party services to order your code for example I for example diligence or anything to run tools that you have their formal verification you know it's still happening you know some people there are new tools obviously I think it's a beautiful form of verification out there there there are few LeDoux's out there that are coming still is an ongoing thing like everything in the space sort of thoughts on man support for like testing month an honor demon powder director casement I have like you should use distance instead of drill bits we have the equivalent of anymore yeah so like yeah yeah and I guess I don't know one other things that because that it's danced like so actually will help you like it some new vulnerabilities identified and and add it to that SW at this yet it will let you know upstream but where does it check for did you learn abilities that are compound there's a registry of all the dozen excesses they check about that it's a new thing makes it to that list they add it and then you go directly to that and they use also like electives that be able to scan muttering in the main Anna SWC become the Rico that holds all the identified vulnerabilities shoot another important thing and I usually run into this you know do you need to make your code or try to keep your code as simple as possible and usually it starts good to start with baby steps and a lot of thing for example there's this was this person that works I am again it was more of a permission meanwhile in New York real estate is a big thing and and there's a lot of permissions and documents that go back and forth a lot of between a lot of different parties so they were trying to tell that you can use blocked in for this makes perfect sense and kindly does however basically what we said is that yeah but don't start with trying to get the whole work thrilling onto smart contract or everything about it locked in because you know it changes in making change a lot you can change and from something so right now I start just by you know figuring out a way how to stamp or how to make sure someone could verify that the documents valid and nobody has changed but you know don't try to get the workflow yet until you really get tested and you know that it works and you know that nuts gonna change because if you want to get you know governmental board you really want that you don't know what they're gonna request to you ah you know dance so first have it running get it there and then you know figured out what becomes actually transaction on repetitive that doesn't change and then try to go try to go from there so it's important that you also think those into account important thing is as you guys know a lot of the things we do is import contracts or use contracts that are consistent that exists out there and they're they're safe there's some that are safe and you can trust because there's the people that are behind them however not necessarily everything out there is safe so it's very important that if you're working with an external contract you really pay attention to it and you really understand what it does you know how to tie it you know all the dependencies have other mantras that you use especially you know so that's your one contract in importance imports a lot that he puts on everything so you really have to check everything that it's related to your country because you never know if there's something that not necessarily it's a you know with a bad intention but you know maybe just some was not relative to some of the contracts that you know big dumb person was just not really that diligent with it and and just you know forgot to check something or to change something or just upgrade some constant so it's very important that you take into account that yes exactly is I think it's I think they also mentioned that on the compiler you know how it changes and everything specially does you know I mean solidity is still and when there's no one yeah right so it's it's important that you take into account everything there and so now let's get a little bit more about those recommendations about the code a few things so some codes that we're gonna see them you know like basic mistakes that people make is you know how if it executed there's there's it's important in the orden of how things happened so the last thing that you want that you want to do in the code is to send money you first need to make all the change well first check all the conditions is very important that you first check conditions so that you know that everything's correct as you know normal programming then effect all the states are will start need to be changed because and this is what we're going to see we entrance e attack happens when you know I first sent you the money and then I change your balance in that sphere in that small period of time the haulback function kicks in and you know gets all the all the all the hacking and so it's very important that you always try to remember prior to part to live to do everything that implies an external thing of your contract for the last everything that it's internal to a contract should happen first and it's very important that you always think that you know your everyday been abroad do everyday you know like don't forget to do that then you also to the interesting thing is that if you have a function that you check that you know whatever it's coming in with when it's golden he doesn't have any strange data on it so you get out of that small require there just to make sure that you know there's nothing strange coming in to your contract for the fallback important that's there was mentioned you know changes happen in solidity very often like new words get deprecated and you would save us it's impossible to know exactly what will happen in the future but as much as you can try to work with the most reliable and up-to-date version of everything cuz they're introducing changes quite often but those changes are really important and as much as possible try to always work without most latest and most stable version of whatever is out there especially with echo and just like he was saying it's very important that it's neither to a specific version even if you could put like anything from here and above usually that will work then it's better if you fix it and you live it fixed so that you never get the chance that some word is deprecated or something could be done in a different way because you never know every time you pick something you wrote something somewhere else so you never know what will what other back door will be open one windows one so it's very important that you always at least as much as possible try to know what you're facing it and the visual challenges that you might be brought to you too so we're just gonna explain a little bit based on that like you'll be entered to see attack I know that this is fun let me see how well can this but just I'm just gonna quit this show to be too smart to you simple smart contracts just to show like the malicious and the vulnerable contract this there's nothing really complicated here for those of you re also new I don't think you're gonna have any issues understanding it but basically this is just a contract that just gets money and you know it will give you back one Easter at a time that's that's all it does that's nothing there's just two functions well this makes you feed the deposit that will just get one one eat there or more yes yeah good idea thank you all right I think that's better so basically just gets one ether more that's it nothing else is just for the purpose of the exercise there's the function that takes the money out and this what we're saying the issue that we have here is that your first kind of sending the money and then you're affecting the variable of this thing so my balance is like okay I'm gonna give you five so I first give you five and then I go ahead and down and up on the ledger so that's that's the you should have a see that this mother hasn't and you just have you know a function just to get balance so that's what you know that the the vulnerable contract after we enter this you know then the militia demolicious come truck honestly the only thing I'm having is as probably you'll know or most of you probably know even heard is an object or in the programming language so basically all I'm saying and just I'm just creating the DOS inherit and everything from the contract and I'm just passing it the address of the contract that I want to attack because I have that address and you know you can import it there really depends on how you do it base is there and then you just have everything and the important thing here is if you see I have a whole back function and therefore that function is just checking if the contract has money that's one big one be fair reward that's anything does he just asked it calls the function will draw again that what the fallback function is doing here right rather than being just an empty thing where you're just you know just have it there just in case for whatever something comes in or something now I have actually a piece of code that would run with this function sport right and basically the structure is similar again so because the Internet was a little bit bad I just want to take it and your missus so here's basically this is the code of the distinct oh I'm not really gonna make it that big as long as you've seen devotees trust me it's the same thing and so basically I happen to contract employ all right everybody knows where that's here I figured yes I know there's some people there's you so basically all I'm going to do is like let's say this poor guy over here is been on deposit and eat here right so I deposit - the world will contract right so we get the balance balance oh yeah we're really doesn't other know if it meant bigger words it has 10 to 10 99 that's what it asked right if you get if I get check the balance of the malicious contract you just has plenty - so you only think that right now if I if I just want to get it up I just I give it the first contract the first thing to do is that I need to get this malicious contract in the mapping in the contract that I want to attack so the first transaction that actually happened it was this contract deposited one eat in the vulnerable contract so that it is in that in the main thing of people that could withdraw money because if you read the code you can see that you know if you're there you're able to withdraw money that's the only thing that the previous step that happened there right so now the only thing I have to do I know that this is the attackers address withdrawal and if you see it takes some time because it's just it's not it's just running and if we just check this balance here you see now it doesn't have ten you just have the 99999 because I do all the technique out if I just check this about that here you see doesn't have 22 we have 32 but the code says only to take one and then get the money why because what it's happening is that at the time that they send me the money in the room in there in the malicious contract the whole back function kicks in so it calls the function again so the functions another one calls the function again and it just stays there also the condition is is out which is when you don't have one e that's why this 9 999 there so that sequence he attack in something similar to this is what happened with the Dow and and it's something that is not really hardcore boy it's just we were explaining before he's just a matter of how you affect everything's so whatever you're doing externally to your contract she openly must be the last thing that the function should do no after any uncertainty but basically before any other 480 2000s there another kind of a common attack how many of you are familiar with the DX origin attack okay as soon as hats off gonna go into more into it basically there's how many of you are familiar with the MSG thoughts ender instruction or keyboard or demo so MSG said they're basically just gives you the address of whoever is giving it's interacting with your contract so whoever sent the transaction whether whether that's a contract or a person so as you guys know what happens a lot in this phase is that you actually have some person that sends something to a contract and that contract may call someone so for whatever reason the third contract or the second contract in this equation wants to know because you are going to send money and you don't want to send it back to the to the first contract you want to send it directly to the user right to avoid chaos and a lot of for the top reasons for that you use TX origin so you know what which is the address that it started the whole transaction in itself right so that's handy in that case so you've been withdraw or like thinking money how it would be happy so you don't have to pay for whatever reason anyone who's in the middle right or like or have a lot of transaction happening for everything that is in the middle however in in also could work to impersonate and what happens is that let's say what's her name do you think so let's say I want to do personate him so what I would figured out and they take that her name is Jason Jason so the the contract he wants to really interact with this JC's so what happens is that I figured out a way to trick him to think that I haven't a C's contract I don't know you know do fishing and whatever it looks like it or something anything is wallet or you know exchange or whatever thing I don't know I just figured out a way to trick to trick it so you'll send a transaction to me and what I will do is then then I will send it to JC right but you because he uses TX origin then he's going to think that is actually him who's getting the money for whatever reason depending on how the code is I would be able to perhaps do something that I'm not supposed to do maybe not necessarily still funds because it still is just gonna refund that your surgeon harvest but I might be able to break something or two maybe getting in the fall but function up or do something there that you know I don't want that didn't is not be accounting for now that's that's our thing here where your code is hopefully is that people could be really clever and figure it out how to attack it definitely two more together simple and that's so that's a little bit about that its origin so I'm not saying enough to use it but you have to be careful for what you use it so did so that you are not really opening the door for someone to if they managed to make this trick to you to do to try to do something to your code or to take a of anything that isn't in your contract and so I so another thing that could happen is is similar which is kind of a denial of service kind of a thing that's the best name of it but but basically what happens is left similar let's say this is an example of let's say I have a magazine and you subscribe to it and you know you pay me monthly or for whatever reason you you pay me on a recurring basis but I also have my function value briefed on fees for something Ella for fun everybody you know I'm shutting it down I'm refunding everybody because I'm changing the code to a new coach people just for them to be happy I'll just give them back the money as a business person because I'm going to change this my contract and have a new one I don't know whatever you know you to figured our photo so that in these cases is like really hard to find specific one but let's say that I have a function when I look through the an array of all my the people that has been subscribe and to refund every one so basically what I could do here is that I could get rather than someone's like an externally on account address there I could get a contract and what happens is that when this person is like ok I'll give you back your fee and I your address out but I actually do is that here I have a pull back and just get it there so that is this function never finishes because I just keep keeping track I'm not earning money out of it I'm not really the only thing I'm doing is to break your system there's not necessarily giving you any economical gain for me but I just find a way to break your system and they think that happens is basically that so because it will not happen or I could put a condition for example like one equals zero that's false you will always be false require one equals zero that's always false so he's got to turn back to give back an error so this thing is gonna remember it so you're never gonna be able to pop my address out of the array and you're never gonna be able to look through the entire array I didn't get any money I didn't got anything out of it just you know maybe cost you a lot of pain with your reducers right because of course if you don't have any other functions any other way to refund the users you're not going to be able to respond them right so this is why I all say it's very important that you you have to think about all the things that could go wrong in again it's as simple as first think that undersell affect everything internally in your contract then do whatever you do an external you know that could you know not necessarily solve everything but probably will help you a lot so how do you face this vulnerabilities like you said there's ESWC director this which you know there you could go it's very good very uh it's you have examples of go there you have examples of solutions there so I definitely some sort that you should check and then you should you know they have miss it every now and then because it's updated but there's also called design patterns there's things that you know people try to put in place so that you kind of a if you implement those in your code you're I'm not gonna say you're bulletproof but at least you know that we're prepared to face some of the most common things that until somebody Moore's much more smarter comment saying and finds another backdoor we're gonna be able to at least protect yourself so I'm just not I'm not gonna go through all of them this is quite simple and even if you know some you for you might be obvious we have the survey's it is very important that you try to take advantage of the modifiers and have permissioning to what who could do what because if not if you just have it public or if you have it or you didn't put tribe and oh you don't have anything you know anyone could execute something and again sometimes people forget how different it is to work on for you guys probably like second nature now but for other developers that are more useful on premises or all the kind of things it's it's a shift in their mindset so it's very important that you always also forget don't forget about these kind of things so you take advantage of the modifiers to use the mouse who has permission to do what on your contract then I'm kind about what we're saying and very important is that you know you do you know who can explain the difference between require and assert for conditions when do use one yes it's about suspending the gossiping what difference is that assert will burn a little painful the gasoline out there require will give you back in case of failure will give you back there may be gaps camp that's custard yes sort of should never occur wrong time yeah that's true so usually you first require and you leave a third for the blast piece of it okay so this is usually that's an important ordering that you have for how habits like whatever is we extreme or everything shouldn't that you know it's the microsite think that might happen that could break or something order you can call into that like what to do a reason for you to use a service for certain fairies right things that you never want to happen right so like if you let's say if you don't want the balance of your smart object for me one the way he designed it she never people though juanita rate the wizard is implemented solidity that he actually uses a different outcome right at the valid all coded as opposed to the elementary burning structure and composition now what this allows is that we do like problem verification tool would be like from from consensus diligence or from the trail of bits you should use the consistence diligence parts but older them work the same way you can use the assert indecent for those tools to be able to see if anything is violated in your smart contract right now I do think that the solidity team like also has the SMT checker updated right now but to be able to audit generate these these assertions relations based on your code alone but yeah you can and these yourself and then run the tools and make sure that none of these assertions are violated with the help of like the automated tool for example I know that some of the people that have made icos or something like something some things of the actors I think they had like a searchlight if there's a section is over ten percent of the volume stopping so what's the benefit of burning the gas for assurance where is it visit to the extremity of it you want to there maybe like to paint your interior incentive behind that bright ahead the way they're used today most pleased that they should never be treated so like that's white before it is better right like the beginning that you think the the yonk oh that actually returns the remaining gas to the user it didn't exist rage those two the guy who played the transaction that didn't exist so this is all yet when the game into existence it doesn't make much sense to use this unless you want to and these are again these are meant to be in various stuff that will not have been hampered by specification so you're basically specifying you you're basically translating the intent into salinity placement rates like you're saying this shoe and never ever anything does everything to stop and that's when those automated so those that I said verify that your assumptions were wrong details so I'm not sure who I'm certain like there is no intravenous for me and they should be above this I know that like I said to somebody about my contract some of the changes that you suggested ye was that if there were two transaction to where like about 5% of the total cooking supply or a few things like a great strange thing that should not have been an illegal normal or stasis to have that stopped so what do you notice this may be more confusing that it it's not I don't know I didn't you tell me but like one good example like the reverb versus a certain table discussion is safe back by opens up you guys know what's a Memphis the library that actually checks that they're older clothes and and they're frozen would not do not have been trained it's a safe way to do that in basically you was equal in to be the certs and what this meant he opens up his head was that if it's an assert each it never happened so your thought should already make sure that overflows do not happen however people were not using you know people were using it to protect themselves then right so opens up in green boxes now what it does yeah that's ego me yes yeah yeah sure I guess difference is that like three slices I don't and maybe all stealth excitation so they have local artisans all you require statements used to record office so like they actually returned gas message yeah yeah it's not accessible yeah you could put like a not something but every condition do you just want to know I just put it out there yeah this might be like earlier Goethe in the beginning to inquire a statement Stephen even allow you to put messages and now they both used to refer top but it be still in the defense before stopping execution so that but it's important that I mean that you always try to make sure I will require with its statement or serve depending on you know kind of a thing that you always check for behavior of your contract he always stays that was of it but at the end that's the most important thing that your country behaves as you expected that it will behave then well like I said basically this is just all the effects interaction which is just you know everything internal than external and basically you know of daily requirements state variables and then whatever those external payment all that that will save you a lot of trouble it's very simple to actually remember so don't forget then there's also times where you may want your contract to stop running I like for example like I will say no this guy's with the ICO they figured out that you know their beam Act they managed to stop that's not good but you know you they never know something else will comment so you know I want this to stop Oh in my contract for a time this is all right so you could have those and they're not that difficult just you know boolean variable basically that only specific person would put up with a conditioning to do animals will open or close that door and have it there so that you use make sure but you could have this emergency stop in case of the cavity or you know you can find me on that also buddies figuring out a way to take money out no not not happening happening right now if I see the money going down I want to stop this or something very important that you think you know all those kinds of things and like I've said this is just like thank you from this beginning it's like do I want it to I don't want it you know it's very important that you stop to think about your contract what features you want to have your contractors once it's out there you know it's pretty not that simple to make changes to it I'm sorry do you then add in like that is stock flag throughout your code like you do checks against that or my god yeah basically I'll turn this and but basically if you see at the end it's like emergency withdrawal in this specific case when you just happens like yeah your contract has to be stopped and for whatever reason like somebody's taking Tony Ali's not say so you tell like hey it's all safe I need to take the money out I'm out at the time stuff so it's tough you stop it and then you take all the funds out you know so yes you put it there and under the circumstances that you stop that you you check that the variable is stopped it or like if it is before any payments you may want to check that it is it really whether you do it or not it will depend on you know how critical it is or how important it is but you can always have plaques that could allow you to stop something or even to put timers of things here's the stuff go no go where you don't have time here for example so that's something does it happen you know five percent though you can know you can know withdrawal or five percent if not in 24 hours kind of a thing you know for example you could have something therefore that you usually have like a modifier but not stop ah stop it easily opens ugly has like various endured libraries to this urges contracts agent in there I'm talking the light bottoms on top of that if you got a idea search for open that mean Google like they have a bunch of stuff including their framework which they have an OS and they have like that was that normal like something three framework that it just has a lot of reusable components it plugin click there then you know like a variable contracts also comes basically well you have there is just you not proxy contract is the only thing is just being connecting you between data and the logic of the contract sometimes so far in this accessible first basically what you just have here is that you know you have let's fold the oddness with the latest version of the contract that you want to use for whatever thing that you're running or for whatever process is there that you want to have and basically this contract the only thing that it does is just holding the data right and so basically if you would need it to change because the locational under your company deployed a new version of my contract let's say in that new version you added the stop for example right for whatever reason so you would come here you would update the the you'll tell it now whatever thing that happens you have to interact with this view contract that I deploy so you kind of have given the new address point you know that it's like I look working with this contract now you're talking about the contract so that contract that's whatever we see you no longer want to use you know you can disable it you can tell the structure if you just leave it there whatever you want to do but now important thing in this kind of a weight also they kind of a split a little bit of like the data and the maybe the logic the business logic of your application and that I bought the same fashionable internal storage' nation when I thought to be brings up the finest they passed a lot of our thanks but just to make it really we kind of wrote it a little bit another and this is more about like recommendation things it's like you guys know like I said that storage is important everything is by 32 word and all that so even if doesn't seem like a big difference or like something that you would say like if you already how do you order your your state garbage navigate because if you're able to pack them in 32 in back to 32 that everything you make a more optimal use of space and if you actually we use this town gas consumption so another common error recommendation there is you know when you have your state variables and you have everything there you know for whatever we should move it out a way how to better arrange them it could be important depending on a lot of the circumstances of what your department does or why you're doing it it's a fun turn factory or different things out there it could be a yeah for example here just a 16 16 to 32 and 16 won't happen is that where I'm if I'm wrong hello is that basically you're not gonna there's gonna be any spaces in the middle because the word is started you so it's 13 7 16 now I need to put 3200 I didn't have space are you ten other I use one of those facing the staff or now I got sixteen so there's gonna be empty spaces so if you put 16 16 they're gonna be better packed so just look to them but the way this so did you talk about Oryx is migrating from top to bottom like whatever whatever it is he'll always read the stuff we talked about and in the reason why these subsets of this this way you would read 16 bytes and he wouldn't tribute it into a storage slot and then the way in words this weighs exactly because there are stars plots that get used right so this would be started slot number 0 in now it tries to ride to the second slot because obviously if each slot is 32 bytes is 32 bytes 150 feet in the first one now if you do it like this this little mother will loop this in the first part of the 32 bytes into the zeros slot right and then he still has like another 16 byte addressable light and then it takes these just like looks coming for the VA kind of yeah I was thinking this the C compiler actually does like actually seen us like hacking optimization and in your favorite kind of stuff its validity how do you mean yeah this is this impacts it up so like actually sounds like everything is 32 bytes yeah but if exactly what it does for you if you put this in C you kind of uh the paydirt antenna for the sole superpower things without sure their relative is easier this is complicated aside not going to get it with a trapeze gets tricky fussing reason why is that so because of this lithium has some negatives right in each of these slots so they are shared in between contracts so like if solidity if they're not like if there is in like a clear rule another clear rule as to how solidity does that time vacuum and then right now he's from top to bottom maybe like a better solution could be this task you know like it's it's just a 80 expect to do the trade language like you can do it a million ways to plate this is this is how he doesn't like if you night from this contract the layup storage of the narrative contract will be exactly the same right so I salinity like slight we're able to give the transactions for example like sending one each is 21 dr. cost of the transaction but it's not because of this common one it's like transactions amended language many 1000s because like that's done many men here this this might I don't know this you're fighting you doing this might be wrong in the sense that this may be what I may have weekly this and what I meant here it was that my execution I mean like when you guys have been executed at least once first yeah it doesn't it doesn't make much sense to talk about execution class if you just point [Applause] [Music]