You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
# Description
- Adds createX predeploy
- Rewrite security and best practices
- More contracts in protocol ecosystem page
## Linked Issues
N/A
## Additional context
Feedback from Sophon team
description:Guidelines to help you build secure, efficient, and maintainable smart contracts on ZKsync chains powered by the EraVM.
4
4
---
5
5
6
-
Before diving into development on ZKsync Era, it's crucial to consider the following recommendations. These best
7
-
practices will help you optimize your code, ensure security, and align with the unique characteristics of ZKsync Era.
6
+
Before developing on a ZKsync chain, review these best practices. Following these recommendations will
7
+
help you optimize performance, maintain security, and align your contracts with the design of the EraVM.
8
8
9
-
## Use `call`over`.send` or `.transfer`
9
+
## Use `call`instead of`.send` or `.transfer`
10
10
11
-
Avoid using `payable(addr).send(x)`/`payable(addr).transfer(x)` because the 2300 gas stipend may not be enough
12
-
for such calls, especially if it involves state changes that require a large amount of L2 gas for data. Instead, we recommend using `call`.
11
+
Avoid using `payable(addr).send(x)` or `payable(addr).transfer(x)`.
12
+
These functions only provide a 2300 gas stipend, which may not be enough if the call triggers state changes or other operations that require more L2 gas.
13
13
14
-
Instead of:
14
+
Use `call` instead.
15
+
16
+
**Instead of:**
15
17
16
18
```solidity
17
-
payable(addr).send(x) // or
18
-
payable(addr).transfer(x)
19
+
payable(addr).send(x); // or
20
+
payable(addr).transfer(x);
19
21
```
20
22
21
-
Use:
23
+
**Use:**
22
24
23
25
```solidity
24
26
(bool s, ) = addr.call{value: x}("");
25
27
require(s);
26
28
```
27
29
28
-
This converts the `send`/`transfer` functionality to `call` and [avoids potential security risks outlined here.](https://consensys.net/diligence/blog/2019/09/stop-using-soliditys-transfer-now/).
30
+
This approach replicates the behavior of `.send` or `.transfer` while providing more flexibility and avoiding gas-limit issues.
31
+
See [Consensys’ explanation of `.transfer` risks](https://consensys.net/diligence/blog/2019/09/stop-using-soliditys-transfer-now/) for additional context.
29
32
30
-
While `.call` offers more flexibility compared to `.send` or `.transfer`, developers should be aware that `.call`
31
-
does not provide the same level of reentrancy protection as `.transfer`/`.send`. It's crucial to adhere to best
32
-
practices like the checks-effects-interactions pattern and/or use reentrancy guard protection to secure your
33
-
contracts against reentrancy attacks. It can help ensure the robustness and security of your smart contracts on the ZKSync VM, even under unexpected conditions.
33
+
While `.call` is safer in terms of gas, it does not provide built-in reentrancy protection. To prevent vulnerabilities:
34
34
35
-
## Use the proxy pattern at the early stage of the protocol
35
+
- Follow the **checks-effects-interactions** pattern.
36
+
- Use a **reentrancy guard** when interacting with external contracts.
36
37
37
-
ZKsync Era is based on the zk-friendly VM. Thus, we offer
0 commit comments