Security best practices

​

Private key management

• Store private keys in environment variables loaded from .env files that are gitignored
• For production deployments, use a hardware wallet (Ledger/Trezor) or a secrets manager (AWS Secrets Manager, HashiCorp Vault)
• Rotate keys immediately if any exposure is suspected
• Use separate deployment keys for testnet and mainnet — never reuse keys across environments

​

Smart contract security

​

Reentrancy

// ✅ Safe: update state before external call
function withdraw(uint256 amount) external {
    require(balances[msg.sender] >= amount, "Insufficient balance");
    balances[msg.sender] -= amount; // Effect first
    (bool success, ) = msg.sender.call{value: amount}(""); // Interaction last
    require(success, "Transfer failed");
}

// ❌ Unsafe: external call before state update
function withdraw(uint256 amount) external {
    (bool success, ) = msg.sender.call{value: amount}("");
    balances[msg.sender] -= amount; // Too late
}

​

Integer overflow

​

Access control

import "@openzeppelin/contracts/access/Ownable.sol";

contract MyContract is Ownable {
    function sensitiveOperation() external onlyOwner {
        // ...
    }
}

​

Input validation

• Validate all user-supplied inputs at the start of functions
• Check address parameters are non-zero
• Bound numeric inputs to reasonable ranges

​

Auditing

1. Internal review — Have at least one other developer read every line
2. Static analysis — Run Slither or Mythril
3. External audit — Engage a professional audit firm for high-value contracts
4. Bug bounty — Consider a public bug bounty program post-deployment

​

Deployment checklist

​

EVM version

​

RPC security

• Use HTTPS endpoints only in production — never plain HTTP
• Do not expose private node RPC endpoints publicly
• Implement rate limiting on any middleware that proxies RPC calls
• Never log raw transaction data that may contain private keys or sensitive parameters

​

Upgrade patterns

• OpenZeppelin UUPS Proxy
• OpenZeppelin Transparent Proxy