Eos Smart Contract Security Best Practices

Review an EOS contract for documented security issues

Use the guide’s vulnerability examples and defenses to review EOS contract code for numeric overflow, authorization, action/code validation, and fake transfer notifications.

Before you start

• An EOS smart contract to review.
• Familiarity with reading EOS contract code and the guide’s examples.

Steps

1. Check arithmetic for unchecked boundary conditions; where applicable, prefer asset operations over extracting and calculating on the balance.

2. Verify that operations authorize the account whose assets are being transferred, including checking the transfer source with require_auth(from).

3. Check that each critical action is paired with an allowed code, following the guide’s apply validation example.

4. When handling a require_recipient transfer notification, ensure transfer_data.to == _self; otherwise return.

Guide limitations

• The guide identifies these checks as a starting point, not a complete security review; it notes that threats change and that known-vulnerability checks alone are insufficient.
• The guide recommends thorough testing, including retesting when new attack methods are found, but this recipe does not specify test procedures.