Smart Contract Dependencies: Recommendations and Security¶

Software supply chain attacks grow more prevalent every year, and a smart contract development environment is an attractive target. Protecting it starts with a careful understanding of every dependency in the project, the smart contracts and the development tools alike.

Use Known-good Libraries¶

Prefer well-known libraries such as the OpenZeppelin smart contract collection. Third-party code should carry an audit from a reputable company with publicly accessible reports, and the repository should follow a strict open-source workflow with transparent review processes for pull requests. Where a third-party codebase is mission-critical, commissioning an audit of it is a sound investment.

Regular Dependency Checks¶

Third-party dependencies earn no blind trust, whatever their open-source status or auditing history. Review each dependency at least once and declare fixed versions of all of them explicitly. Check for new versions, review their code, and test them frequently, and run the simpler checks automatically as part of the build and continuous integration process. Review the repository precedence configured in the development tools regularly as well, which is what keeps dependency confusion attacks out.

Dependency Hygiene¶

Every additional dependency widens the attack surface of a smart contract. Diligent internal quality assurance removes redundant dependencies, and the development team needs to understand the function of each remaining one and its role in the broader system. In the same spirit, avoid large dependencies pulled in for a small subset of their code. Where two dependencies overlap, keep the one whose overlap with the project requirements is greatest.

Review Security Bulletins¶

Stay on top of security news for the project's dependencies through mailing lists, forums, or the library developers' social media accounts. The development community is usually the first to become aware of a security issue, which makes it the most timely source of updates and alerts.