MODULE 4: ETHEREUM AND SMART CONTRACT DEVELOPMENT (Continued)

ERC-20 Interface:

interface IERC20 {
    function totalSupply() external view returns (uint256);
    function balanceOf(address account) external view returns (uint256);
    function transfer(address recipient, uint256 amount) external returns (bool);
    function allowance(address owner, address spender) external view returns (uint256);
    function approve(address spender, uint256 amount) external returns (bool);
    function transferFrom(address sender, address recipient, uint256 amount) external returns (bool);
    
    event Transfer(address indexed from, address indexed to, uint256 value);
    event Approval(address indexed owner, address indexed spender, uint256 value);
}

ERC-20 Implementation:

import "@openzeppelin/contracts/token/ERC20/ERC20.sol";

contract MyToken is ERC20 {
    constructor() ERC20("MyToken", "MTK") {
        _mint(msg.sender, 1000000 * 10**decimals());
    }
    
    function decimals() public view virtual override returns (uint8) {
        return 18;  // Standard for most tokens
    }
}

Custom ERC-20:

import "@openzeppelin/contracts/token/ERC20/extensions/ERC20Burnable.sol";
import "@openzeppelin/contracts/access/Ownable.sol";

contract MyToken is ERC20, ERC20Burnable, Ownable {
    constructor() ERC20("MyToken", "MTK") {
        _mint(msg.sender, 1000000 * 10**decimals());
    }
    
    function mint(address to, uint256 amount) public onlyOwner {
        _mint(to, amount);
    }
    
    function burn(uint256 amount) public {
        _burn(msg.sender, amount);
    }
}

ERC-20 with Emergency Stop:

import "@openzeppelin/contracts/token/ERC20/extensions/ERC20Pausable.sol";

contract MyToken is ERC20, ERC20Pausable, Ownable {
    constructor() ERC20("MyToken", "MTK") {
        _mint(msg.sender, 1000000 * 10**decimals());
    }
    
    function pause() public onlyOwner {
        _pause();
    }
    
    function unpause() public onlyOwner {
        _unpause();
    }
    
    function transfer(address recipient, uint256 amount) 
        public 
        override 
        whenNotPaused 
        returns (bool) 
    {
        return super.transfer(recipient, amount);
    }
}

ERC-721 Interface:

interface IERC721 {
    function balanceOf(address owner) external view returns (uint256 balance);
    function ownerOf(uint256 tokenId) external view returns (address owner);
    function safeTransferFrom(address from, address to, uint256 tokenId) external;
    function transferFrom(address from, address to, uint256 tokenId) external;
    function approve(address to, uint256 tokenId) external;
    function getApproved(uint256 tokenId) external view returns (address operator);
    function setApprovalForAll(address operator, bool approved) external;
    function isApprovedForAll(address owner, address operator) external view returns (bool);
    
    event Transfer(address indexed from, address indexed to, uint256 indexed tokenId);
    event Approval(address indexed owner, address indexed approved, uint256 indexed tokenId);
    event ApprovalForAll(address indexed owner, address indexed operator, bool approved);
}

ERC-721 NFT Implementation:

import "@openzeppelin/contracts/token/ERC721/extensions/ERC721URIStorage.sol";
import "@openzeppelin/contracts/access/Ownable.sol";

contract MyNFT is ERC721URIStorage, Ownable {
    uint256 public tokenCounter;
    mapping(uint256 => string) private _tokenURIs;
    
    constructor() ERC721("MyNFT", "MNFT") {
        tokenCounter = 0;
    }
    
    function mint(address to, string memory uri) public onlyOwner {
        uint256 tokenId = tokenCounter;
        _safeMint(to, tokenId);
        _setTokenURI(tokenId, uri);
        tokenCounter++;
    }
    
    function tokenURI(uint256 tokenId) 
        public 
        view 
        override 
        returns (string memory) 
    {
        return super.tokenURI(tokenId);
    }
}

NFT with On-Chain Metadata:

contract OnChainNFT is ERC721 {
    struct NFTMetadata {
        string name;
        string description;
        string image;
        uint256 attributes;
    }
    
    mapping(uint256 => NFTMetadata) public metadata;
    
    function mint(
        address to,
        uint256 tokenId,
        string memory name,
        string memory description,
        string memory image
    ) public {
        _safeMint(to, tokenId);
        metadata[tokenId] = NFTMetadata(name, description, image, 0);
    }
    
    function tokenURI(uint256 tokenId) 
        public 
        view 
        override 
        returns (string memory) 
    {
        NFTMetadata storage meta = metadata[tokenId];
        return string(
            abi.encodePacked(
                'data:application/json,{"name":"',
                meta.name,
                '","description":"',
                meta.description,
                '","image":"',
                meta.image,
                '"}'
            )
        );
    }
}

ERC-1155 Interface:

interface IERC1155 {
    function balanceOf(address account, uint256 id) external view returns (uint256);
    function balanceOfBatch(address[] calldata accounts, uint256[] calldata ids) 
        external view returns (uint256[] memory);
    function setApprovalForAll(address operator, bool approved) external;
    function isApprovedForAll(address account, address operator) external view returns (bool);
    function safeTransferFrom(address from, address to, uint256 id, uint256 amount, bytes calldata data) external;
    function safeBatchTransferFrom(address from, address to, uint256[] calldata ids, uint256[] calldata amounts, bytes calldata data) external;
    
    event TransferSingle(address indexed operator, address indexed from, address indexed to, uint256 id, uint256 value);
    event TransferBatch(address indexed operator, address indexed from, address indexed to, uint256[] ids, uint256[] values);
    event ApprovalForAll(address indexed account, address indexed operator, bool approved);
}

ERC-1155 Implementation:

import "@openzeppelin/contracts/token/ERC1155/ERC1155.sol";
import "@openzeppelin/contracts/access/Ownable.sol";

contract MyMultiToken is ERC1155, Ownable {
    uint256 public constant GOLD = 0;
    uint256 public constant SILVER = 1;
    uint256 public constant WEAPON = 2;
    
    constructor() ERC1155("https://example.com/{id}.json") {
        _mint(msg.sender, GOLD, 1000, "");
        _mint(msg.sender, SILVER, 5000, "");
        _mint(msg.sender, WEAPON, 100, "");
    }
    
    function mint(address to, uint256 id, uint256 amount) public onlyOwner {
        _mint(to, id, amount, "");
    }
    
    function mintBatch(address to, uint256[] memory ids, uint256[] memory amounts) public onlyOwner {
        _mintBatch(to, ids, amounts, "");
    }
}

ERC-4626 Interface:

interface IERC4626 {
    function asset() external view returns (address);
    function totalAssets() external view returns (uint256);
    function convertToShares(uint256 assets) external view returns (uint256);
    function convertToAssets(uint256 shares) external view returns (uint256);
    function maxDeposit(address receiver) external view returns (uint256);
    function previewDeposit(uint256 assets) external view returns (uint256);
    function deposit(uint256 assets, address receiver) external returns (uint256);
    function maxMint(address receiver) external view returns (uint256);
    function previewMint(uint256 shares) external view returns (uint256);
    function mint(uint256 shares, address receiver) external returns (uint256);
    function maxWithdraw(address owner) external view returns (uint256);
    function previewWithdraw(uint256 assets) external view returns (uint256);
    function withdraw(uint256 assets, address receiver, address owner) external returns (uint256);
    function maxRedeem(address owner) external view returns (uint256);
    function previewRedeem(uint256 shares) external view returns (uint256);
    function redeem(uint256 shares, address receiver, address owner) external returns (uint256);
    
    event Deposit(address indexed caller, address indexed owner, uint256 assets, uint256 shares);
    event Withdraw(address indexed caller, address indexed receiver, address indexed owner, uint256 assets, uint256 shares);
}

Token Distribution Models:

1. Fair Launch:
   - No pre-mine
   - Equal opportunity
   - Community-driven

2. Private Sale:
   - Early investors
   - Discounts
   - Lock-up periods

3. Public Sale (ICO/IDO):
   - Public participation
   - Crowdfunding
   - Regulatory considerations

4. Airdrop:
   - Free distribution
   - Community building
   - Marketing

5. Staking Rewards:
   - Lock tokens
   - Earn yield
   - Long-term alignment

Economic Design:

1. Supply:
   - Max supply: Hard cap
   - Circulating supply: Available
   - Total supply: Including locked

2. Distribution:
   - Team allocation
   - Investor allocation
   - Community allocation
   - Treasury allocation

3. Incentives:
   - Staking rewards
   - Liquidity mining
   - Governance participation

4. Utility:
   - Governance rights
   - Fee reduction
   - Access to services
   - Voting power

5. Value Accrual:
   - Fee sharing
   - Buyback and burn
   - Revenue distribution

Token Security Checklist:

☐ Reentrancy protection
☐ Access control
☐ Overflow protection
☐ Pausable for emergencies
☐ Upgrade path (if needed)
☐ Audit completed
☐ Bug bounty active
☐ Test coverage > 95%
☐ Documentation complete
☐ Emergency withdrawal

Best Practices:

1. Use OpenZeppelin libraries
2. Implement proper error handling
3. Add events for all important actions
4. Consider upgradeability
5. Add pause functionality
6. Multiple independent audits
7. Limit admin privileges
8. Use timelocks for sensitive operations
9. Monitor for suspicious activity
10. Regular security updates

Web3 Architecture:

┌─────────────────────────────────────────────────────────────────────┐
│                    Frontend (UI/UX)                                │
│  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐              │
│  │  React/Vue  │  │  Web3.js    │  │  Ethers.js  │              │
│  │  Components │  │  Library    │  │  Library    │              │
│  └─────────────┘  └─────────────┘  └─────────────┘              │
└─────────────────────────────────────────────────────────────────────┘
                              │
┌─────────────────────────────────────────────────────────────────────┐
│                    Wallet/Provider Layer                           │
│  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐              │
│  │  MetaMask   │  │  WalletConnect│ │  Coinbase   │              │
│  │             │  │             │  │  Wallet     │              │
│  └─────────────┘  └─────────────┘  └─────────────┘              │
└─────────────────────────────────────────────────────────────────────┘
                              │
┌─────────────────────────────────────────────────────────────────────┐
│                    RPC Layer                                        │
│  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐              │
│  │  Infura     │  │  Alchemy    │  │  QuickNode  │              │
│  │  (RPC)      │  │  (RPC)      │  │  (RPC)      │              │
│  └─────────────┘  └─────────────┘  └─────────────┘              │
└─────────────────────────────────────────────────────────────────────┘
                              │
┌─────────────────────────────────────────────────────────────────────┐
│                    Blockchain Layer                                │
│  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐              │
│  │  Ethereum   │  │  Polygon    │  │  Arbitrum   │              │
│  │  Mainnet    │  │             │  │             │              │
│  └─────────────┘  └─────────────┘  └─────────────┘              │
└─────────────────────────────────────────────────────────────────────┘

Ethers.js Installation:

npm install ethers

// Import
const { ethers } = require('ethers');
// Or
import { ethers } from 'ethers';

Provider Connection:

// Using a local node
const provider = new ethers.providers.JsonRpcProvider('http://localhost:8545');

// Using a public RPC
const provider = new ethers.providers.InfuraProvider('mainnet', INFURA_KEY);
const provider = new ethers.providers.AlchemyProvider('mainnet', ALCHEMY_KEY);

// MetaMask provider
const provider = new ethers.providers.Web3Provider(window.ethereum);

// Get signer
const signer = provider.getSigner();

Reading from a Contract:

// Contract ABI and address
const abi = [...] // Contract ABI
const address = '0x...'

// Create contract instance
const contract = new ethers.Contract(address, abi, provider);

// Read functions
const balance = await contract.balanceOf('0x...');
const totalSupply = await contract.totalSupply();

// View functions with parameters
const allowance = await contract.allowance(owner, spender);

Writing to a Contract:

// With signer
const contractWithSigner = contract.connect(signer);

// Send transaction
const tx = await contractWithSigner.transfer(to, amount);

// Wait for confirmation
const receipt = await tx.wait();

// Check transaction status
if (receipt.status === 1) {
    console.log('Transaction successful');
} else {
    console.log('Transaction failed');
}

Ethers.js Complete Example:

import { ethers } from 'ethers';

class TokenClient {
    constructor(contractAddress, abi) {
        this.provider = new ethers.providers.Web3Provider(window.ethereum);
        this.signer = this.provider.getSigner();
        this.contract = new ethers.Contract(contractAddress, abi, this.provider);
        this.contractWithSigner = this.contract.connect(this.signer);
    }
    
    async connectWallet() {
        await window.ethereum.request({ method: 'eth_requestAccounts' });
    }
    
    async getBalance(address) {
        return await this.contract.balanceOf(address);
    }
    
    async transfer(to, amount) {
        const tx = await this.contractWithSigner.transfer(to, amount);
        const receipt = await tx.wait();
        return receipt;
    }
    
    async getTransactionReceipt(txHash) {
        return await this.provider.getTransactionReceipt(txHash);
    }
    
    async listenForEvents() {
        this.contract.on('Transfer', (from, to, value) => {
            console.log(`Transfer: ${from} -> ${to} (${value})`);
        });
    }
}

MetaMask Connection:

const connectWallet = async () => {
    try {
        // Check if MetaMask is installed
        if (typeof window.ethereum === 'undefined') {
            throw new Error('MetaMask not installed');
        }
        
        // Request accounts
        const accounts = await window.ethereum.request({
            method: 'eth_requestAccounts'
        });
        
        // Get connected account
        const account = accounts[0];
        console.log('Connected:', account);
        
        // Get network
        const chainId = await window.ethereum.request({
            method: 'eth_chainId'
        });
        console.log('Chain ID:', chainId);
        
        return { account, chainId };
    } catch (error) {
        console.error('Connection error:', error);
    }
};

// Listen for account changes
window.ethereum.on('accountsChanged', (accounts) => {
    console.log('Account changed:', accounts[0]);
});

// Listen for chain changes
window.ethereum.on('chainChanged', (chainId) => {
    console.log('Chain changed:', chainId);
});

import React, { useState, useEffect } from 'react';
import { ethers } from 'ethers';
import { ContractABI } from './ContractABI';

function App() {
    const [account, setAccount] = useState(null);
    const [balance, setBalance] = useState('0');
    const [loading, setLoading] = useState(false);
    const [contract, setContract] = useState(null);
    
    const CONTRACT_ADDRESS = '0x...';
    
    useEffect(() => {
        init();
    }, []);
    
    const init = async () => {
        if (typeof window.ethereum !== 'undefined') {
            const provider = new ethers.providers.Web3Provider(window.ethereum);
            const signer = provider.getSigner();
            const contract = new ethers.Contract(CONTRACT_ADDRESS, ContractABI, signer);
            setContract(contract);
        }
    };
    
    const connectWallet = async () => {
        try {
            const accounts = await window.ethereum.request({
                method: 'eth_requestAccounts'
            });
            setAccount(accounts[0]);
            await updateBalance(accounts[0]);
        } catch (error) {
            console.error('Connection error:', error);
        }
    };
    
    const updateBalance = async (address) => {
        if (contract) {
            const balance = await contract.balanceOf(address);
            setBalance(ethers.utils.formatEther(balance));
        }
    };
    
    const transfer = async () => {
        if (!contract) return;
        setLoading(true);
        
        try {
            const tx = await contract.transfer(toAddress, amount);
            await tx.wait();
            await updateBalance(account);
        } catch (error) {
            console.error('Transfer error:', error);
        }
        
        setLoading(false);
    };
    
    return (
        <div>
            {!account ? (
                <button onClick={connectWallet}>Connect Wallet</button>
            ) : (
                <div>
                    <p>Connected: {account}</p>
                    <p>Balance: {balance} ETH</p>
                    <button onClick={transfer} disabled={loading}>
                        {loading ? 'Processing...' : 'Transfer'}
                    </button>
                </div>
            )}
        </div>
    );
}

Gas Estimation:

// Estimate gas
const gasEstimate = await contract.estimateGas.transfer(to, amount);

// Get gas price
const gasPrice = await provider.getGasPrice();

// Calculate total cost
const totalCost = gasEstimate.mul(gasPrice);
console.log('Estimated cost:', ethers.utils.formatEther(totalCost), 'ETH');

// Send with custom gas
const tx = await contractWithSigner.transfer(to, amount, {
    gasLimit: gasEstimate.mul(1.1),
    gasPrice: gasPrice
});

Transaction Batching:

// Batch multiple transfers
const batchTransfer = async (recipients, amounts) => {
    const tx = await contract.batchTransfer(recipients, amounts);
    await tx.wait();
};

// EIP-2718: Typed transactions
// EIP-1559: Dynamic fee market

Error Handling Patterns:

try {
    const tx = await contract.function();
    await tx.wait();
} catch (error) {
    // Check for user rejection
    if (error.code === 4001) {
        console.log('Transaction rejected by user');
    }
    
    // Check for network error
    if (error.code === -32000) {
        console.log('Network error:', error.message);
    }
    
    // Check for contract revert
    if (error.reason) {
        console.log('Revert reason:', error.reason);
    }
    
    // Generic error
    console.error('Error:', error.message);
}

Hardhat Test Setup:

// test/MyContract.test.js
const { expect } = require('chai');
const { ethers } = require('hardhat');

describe('MyContract', function () {
    let MyContract;
    let myContract;
    let owner;
    let addr1;
    let addr2;
    
    beforeEach(async function () {
        [owner, addr1, addr2] = await ethers.getSigners();
        MyContract = await ethers.getContractFactory('MyContract');
        myContract = await MyContract.deploy();
        await myContract.deployed();
    });
    
    describe('Deployment', function () {
        it('Should set the right owner', async function () {
            expect(await myContract.owner()).to.equal(owner.address);
        });
    });
    
    describe('Functions', function () {
        it('Should allow owner to set value', async function () {
            await myContract.setValue(42);
            expect(await myContract.value()).to.equal(42);
        });
        
        it('Should not allow non-owner to set value', async function () {
            await expect(myContract.connect(addr1).setValue(42))
                .to.be.revertedWith('Not owner');
        });
    });
});

Foundry Test Setup:

// test/MyContract.t.sol
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

import "forge-std/Test.sol";
import "../src/MyContract.sol";

contract MyContractTest is Test {
    MyContract public myContract;
    address public owner;
    address public addr1;
    
    function setUp() public {
        owner = address(this);
        addr1 = makeAddr("addr1");
        myContract = new MyContract();
    }
    
    function testDeployment() public {
        assertEq(myContract.owner(), owner);
    }
    
    function testSetValue() public {
        myContract.setValue(42);
        assertEq(myContract.value(), 42);
    }
    
    function testFuzzValue(uint256 value) public {
        myContract.setValue(value);
        assertEq(myContract.value(), value);
    }
}

Hardhat Deploy Script:

// scripts/deploy.js
const hre = require('hardhat');

async function main() {
    // Get deployer
    const [deployer] = await hre.ethers.getSigners();
    console.log('Deploying with:', deployer.address);
    
    // Deploy contract
    const MyContract = await hre.ethers.getContractFactory('MyContract');
    const myContract = await MyContract.deploy();
    await myContract.deployed();
    
    console.log('MyContract deployed to:', myContract.address);
    
    // Verify on Etherscan (if on mainnet)
    if (hre.network.name === 'mainnet') {
        await hre.run('verify:verify', {
            address: myContract.address,
            constructorArguments: [],
        });
    }
}

main()
    .then(() => process.exit(0))
    .catch((error) => {
        console.error(error);
        process.exit(1);
    });

Hardhat Config:

// hardhat.config.js
require('@nomiclabs/hardhat-waffle');
require('@nomiclabs/hardhat-etherscan');
require('hardhat-deploy');

module.exports = {
    solidity: '0.8.20',
    networks: {
        hardhat: {
            chainId: 1337
        },
        localhost: {
            url: 'http://127.0.0.1:8545'
        },
        goerli: {
            url: process.env.GOERLI_RPC_URL,
            accounts: [process.env.PRIVATE_KEY]
        },
        mainnet: {
            url: process.env.MAINNET_RPC_URL,
            accounts: [process.env.PRIVATE_KEY]
        }
    },
    etherscan: {
        apiKey: process.env.ETHERSCAN_API_KEY
    }
};

Verification Process:

1. Flatten the contract
2. Upload to Etherscan
3. Verify on-chain code matches

// Hardhat verification
npx hardhat verify --network mainnet 0x123... "constructor args"

// Using Etherscan API
npx hardhat run scripts/verify.js

// Manual verification
// 1. Go to Etherscan
// 2. Click "Verify and Publish"
// 3. Paste flattened code
// 4. Submit

Proxy Deployment Pattern:

// Deploy implementation
const Implementation = await ethers.getContractFactory('Implementation');
const implementation = await Implementation.deploy();
await implementation.deployed();

// Deploy proxy
const Proxy = await ethers.getContractFactory('Proxy');
const proxy = await Proxy.deploy(implementation.address);
await proxy.deployed();

// Interact via proxy
const proxyContract = Implementation.attach(proxy.address);

Using OpenZeppelin Upgrades:

const { upgrades } = require('hardhat');

// Deploy upgradeable contract
const MyContract = await ethers.getContractFactory('MyContract');
const myContract = await upgrades.deployProxy(MyContract, []);
await myContract.deployed();

// Upgrade contract
const MyContractV2 = await ethers.getContractFactory('MyContractV2');
const upgraded = await upgrades.upgradeProxy(myContract.address, MyContractV2);

Test Coverage Requirements:

1. Positive Tests:
   - Normal operation
   - Expected outcomes

2. Negative Tests:
   - Revert conditions
   - Edge cases

3. Edge Cases:
   - Zero values
   - Maximum values
   - Boundary conditions

4. Security Tests:
   - Reentrancy
   - Access control
   - Overflow/Underflow

5. Integration Tests:
   - Contract interactions
   - Multiple contracts
   - External calls

Pre-Deployment Checklist:

☐ All tests passing
☐ Test coverage > 95%
☐ Security audit completed
☐ Contract verified on testnet
☐ Gas optimization done
☐ Documentation complete
☐ Upgrade path planned
☐ Emergency procedures documented
☐ Monitoring setup configured
☐ Bug bounty program ready

☐ Dry run on testnet
☐ Gradual deployment on mainnet
☐ Monitor for issues
☐ Backup plan prepared

Post-Deployment:

1. Transaction Monitoring:
   - Failed transactions
   - Suspicious activity
   - Gas price spikes

2. Contract Monitoring:
   - State changes
   - Events
   - Balance changes

3. Security Monitoring:
   - Attack attempts
   - Unusual patterns
   - Vulnerability alerts

4. Performance Monitoring:
   - Gas costs
   - Response times
   - Network congestion

Storage Optimization Patterns:

1. Pack Variables:
// Bad: 3 slots
uint256 a;  // Slot 0
uint256 b;  // Slot 1
uint256 c;  // Slot 2

// Good: 2 slots
uint128 a;  // Slot 0 (16 bytes)
uint128 b;  // Slot 0 (16 bytes)
uint256 c;  // Slot 1

2. Use uint256 for operations:
// Bad: Requires conversions
uint8 a = 10;
uint8 b = 20;
uint256 result = a + b;  // Conversion overhead

// Good: Use same type
uint256 a = 10;
uint256 b = 20;
uint256 result = a + b;

Function Optimization:

1. Use external for read-only:
function externalRead() external view returns (uint256) {
    // Cheaper than public
}

2. Use calldata for read-only inputs:
function processData(bytes calldata data) public {
    // Cheaper than memory
}

3. Use view/pure modifiers:
function getValue() public view returns (uint256) {
    // No gas for reading
}

4. Avoid unnecessary storage reads:
uint256 temp = value;  // Read once
// Use temp multiple times

Loop Optimization:

1. Cache loop bounds:
uint256 length = array.length;
for (uint256 i = 0; i < length; i++) {
    // Use length
}

2. Use unchecked for safe increments:
for (uint256 i = 0; i < length; ) {
    // Body
    unchecked { i++; }
}

3. Avoid dynamic array inside loops:
// Bad: Dynamic array in loop
for (uint256 i = 0; i < array.length; i++) {
    uint256 temp = array[i];  // Re-reads length
}

// Good: Cache array element
for (uint256 i = 0; i < length; i++) {
    uint256 temp = array[i];  // Only reads once
}

Assembly Optimization:

assembly {
    // Packed storage
    let slot := sload(0x00)  // Read 256 bits
    
    // Extract values
    let a := and(slot, 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF)  // Lower 128 bits
    let b := shr(128, slot)  // Upper 128 bits
    
    // Pack and store
    let packed := or(a, shl(128, b))
    sstore(0x00, packed)
}

Comprehensive Audit Process:

1. Pre-Audit Preparation:
   - Code documentation
   - Architecture overview
   - Security assumptions

2. Manual Code Review:
   - Logic analysis
   - Security patterns
   - Access control
   - Business logic

3. Automated Analysis:
   - Static analysis (Slither)
   - Security scanning (Mythril)
   - Formal verification

4. Security Testing:
   - Unit tests
   - Fuzzing
   - Penetration testing

5. Reporting:
   - Vulnerability classification
   - Risk assessment
   - Recommendations
   - Remediation validation

Slither Analysis:

# Install
pip3 install slither-analyzer

# Basic analysis
slither contracts/

# Detailed report
slither contracts/ --print human-summary

# Security checks
slither contracts/ --detect-all

# Custom detectors
slither contracts/ --detect reentrancy,unchecked-call

Mythril Scanning:

# Install
pip3 install mythril

# Scan contract
myth analyze 0x123... --solv 0.8.0

# Full analysis
myth analyze contracts/ --all

# Gas analysis
myth analyze contracts/ --gas

Security Best Practices:

1. Use Battle-Tested Libraries:
   - OpenZeppelin contracts
   - Chainlink oracles
   - Standard patterns

2. Follow Checks-Effects-Interactions:
   - Validate inputs first
   - Update state
   - Make external calls

3. Implement Access Control:
   - Ownable for simple
   - AccessControl for complex
   - Role-based permissions

4. Add Emergency Features:
   - Pausable
   - Emergency withdraw
   - Upgrade path

5. Use SafeMath:
   - Pre-0.8.0: Use SafeMath
   - 0.8.0+: Automatic checks
   - Use unchecked for optimization

6. Implement Circuit Breakers:
   - Limit exposure
   - Gradual deployment
   - Monitoring alerts

7. Use Multi-Sig:
   - Critical functions
   - Admin privileges
   - Fund management

8. Regular Security Audits:
   - Multiple firms
   - Independent review
   - Continuous monitoring

Gas Cost Comparison:

| Operation | Gas Cost | Optimization |
|-----------|----------|--------------|
| Storage Write | 20,000 | Cache, pack |
| Storage Read | 2,100 | Cache, reduce |
| Memory Write | 3 | Use memory |
| Memory Read | 3 | Use memory |
| External Call | 10,000 | Reduce calls |
| Internal Call | ~50 | Use internal |
| Arithmetic | 3-5 | Use unchecked |
| Loop | Variable | Limit length |

Audit Report Structure:

1. Executive Summary:
   - Overall findings
   - Risk level
   - Recommendation

2. Detailed Findings:
   - Vulnerability description
   - Code location
   - Impact assessment
   - Recommended fix

3. Code Quality:
   - Code quality assessment
   - Maintainability
   - Best practices

4. Test Coverage:
   - Coverage percentage
   - Missing tests
   - Recommendations

5. Gas Analysis:
   - Gas usage
   - Optimization opportunities
   - Cost estimates

6. Final Recommendations:
   - Prioritized fixes
   - Timeline
   - Validation process