讓合約安全的設計模式：檢查—生效—互動、提領式付款與代理

// VULNERABLE: interaction happens BEFORE the effect
pragma solidity ^0.8.24;

contract Bank {
    mapping(address => uint256) public balances;

    function deposit() external payable {
        balances[msg.sender] += msg.value;
    }

    function withdraw() external {
        uint256 amount = balances[msg.sender];        // Check
        require(amount > 0, "nothing to withdraw");
        // INTERACTION first -- hands control to msg.sender's code:
        (bool ok, ) = msg.sender.call{value: amount}("");
        require(ok, "transfer failed");
        balances[msg.sender] = 0;                     // Effect -- too late!
    }
}

// SAFE: effects committed BEFORE the interaction
function withdraw() external {
    uint256 amount = balances[msg.sender];   // Checks
    require(amount > 0, "nothing to withdraw");
    balances[msg.sender] = 0;                // Effects (state updated FIRST)
    (bool ok, ) = msg.sender.call{value: amount}("");  // Interactions (call LAST)
    require(ok, "transfer failed");
}

uint256 private _status = 1; // 1 = NOT_ENTERED, 2 = ENTERED

modifier nonReentrant() {
    require(_status == 1, "reentrant call");
    _status = 2;
    _;            // function body runs here
    _status = 1;
}

function withdraw() external nonReentrant {
    /* ... checks-effects-interactions still applies ... */
}

// VULNERABLE (push): refund runs inside bid()
contract Auction {
    address public highestBidder;
    uint256 public highestBid;

    function bid() external payable {
        require(msg.value > highestBid, "bid too low");
        if (highestBidder != address(0)) {
            // If THIS transfer reverts, no one can ever outbid again.
            payable(highestBidder).transfer(highestBid);
        }
        highestBidder = msg.sender;
        highestBid = msg.value;
    }
}

// SAFE (pull): bidders withdraw their own refunds
mapping(address => uint256) public pendingReturns;

function bid() external payable {
    require(msg.value > highestBid, "bid too low");
    if (highestBidder != address(0)) {
        pendingReturns[highestBidder] += highestBid;  // record, don't send
    }
    highestBidder = msg.sender;
    highestBid = msg.value;
}

function withdrawRefund() external {
    uint256 amount = pendingReturns[msg.sender];
    require(amount > 0, "nothing to withdraw");
    pendingReturns[msg.sender] = 0;                  // effect before interaction
    (bool ok, ) = payable(msg.sender).call{value: amount}("");
    require(ok, "refund failed");
}

error NotOwner();

address public owner;

constructor() { owner = msg.sender; }

modifier onlyOwner() {
    if (msg.sender != owner) revert NotOwner();  // msg.sender, NEVER tx.origin
    _;
}

function setFee(uint256 newFee) external onlyOwner { /* ... */ }

bytes32 public constant MINTER_ROLE = keccak256("MINTER_ROLE");
mapping(bytes32 => mapping(address => bool)) public hasRole;

modifier onlyRole(bytes32 role) {
    require(hasRole[role][msg.sender], "missing role");
    _;
}

function mint(address to, uint256 amt) external onlyRole(MINTER_ROLE) { /* ... */ }

// Proxy: stores state, delegatecalls ALL logic to `implementation`
contract Proxy {
    // EIP-1967 slot = keccak256("eip1967.proxy.implementation") - 1
    bytes32 private constant IMPL_SLOT =
        0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc;

    function _impl() internal view returns (address a) {
        assembly { a := sload(IMPL_SLOT) }
    }

    fallback() external payable {
        address impl = _impl();
        assembly {
            calldatacopy(0, 0, calldatasize())
            let ok := delegatecall(gas(), impl, 0, calldatasize(), 0, 0)
            returndatacopy(0, 0, returndatasize())
            switch ok
            case 0 { revert(0, returndatasize()) }
            default { return(0, returndatasize()) }
        }
    }
}