Tezos

type storage = {
  owner: address;
  balance: nat;
  paused: bool;
}

type action =
| Transfer of address * nat
| SetOwner of address
| Pause

let is_owner (addr, storage : address * storage) : bool =
  addr = storage.owner

[@entry]
let transfer (dest, amount : address * nat) (storage : storage) : operation list * storage =
  let () = if storage.paused then failwith "CONTRACT_PAUSED" else () in
  let () = if amount > storage.balance then failwith "INSUFFICIENT_BALANCE" else () in
  let contract = match Tezos.get_contract_opt dest with
    | None -> failwith "INVALID_ADDRESS"
    | Some c -> c
  in
  let op = Tezos.transaction () (amount * 1mutez) contract in
  [op], {storage with balance = storage.balance - amount}

type storage = {
  owner: address,
  counter: nat
};

@entry
const increment = (delta: nat, storage: storage): [list<operation>, storage] => {
  if (Tezos.get_sender() != storage.owner) {
    return failwith("NOT_OWNER");
  }
  return [list([]), {...storage, counter: storage.counter + delta}];
};

// ❌ VULNERABLE - state updated after external call
[@entry]
let withdraw (amount : tez) (storage : storage) : operation list * storage =
  let contract = Tezos.get_contract_opt(Tezos.get_sender()) in
  let op = Tezos.transaction () amount contract in
  [op], {storage with withdrawn = true}

// ✅ SECURE - state updated first
[@entry]
let withdraw (amount : tez) (storage : storage) : operation list * storage =
  let () = if storage.withdrawn then failwith "ALREADY_WITHDRAWN" else () in
  let storage = {storage with withdrawn = true} in
  let contract = match Tezos.get_contract_opt(Tezos.get_sender()) with
    | None -> failwith "INVALID_ADDRESS"
    | Some c -> c
  in
  let op = Tezos.transaction () amount contract in
  [op], storage

type storage = {
  admin: address;
  data: big_map(address, nat);
}

let require_admin (storage : storage) : unit =
  if Tezos.get_sender() <> storage.admin then
    failwith "NOT_ADMIN"
  else ()

[@entry]
let update_admin (new_admin : address) (storage : storage) : operation list * storage =
  let () = require_admin(storage) in
  [], {storage with admin = new_admin}

[@entry]
let transfer (dest, amount : address * nat) (storage : storage) : operation list * storage =
  // Validate destination
  let () = match Tezos.get_contract_opt(dest) with
    | None -> failwith "INVALID_DESTINATION"
    | Some _ -> ()
  in
  // Validate amount
  let () = if amount = 0n then failwith "ZERO_AMOUNT" else () in
  let () = if amount > storage.balance then failwith "INSUFFICIENT_BALANCE" else () in
  // ... proceed with transfer

[@entry]
let add_tokens (amount : nat) (storage : storage) : operation list * storage =
  // Validate reasonable bounds
  let max_amount = 1_000_000_000n in
  let () = if amount > max_amount then failwith "AMOUNT_TOO_LARGE" else () in
  // Safe addition with nat
  let new_balance = storage.balance + amount in
  [], {storage with balance = new_balance}

[@entry]
let check_deadline (storage : storage) : operation list * storage =
  let now = Tezos.get_now() in
  let () = if now > storage.deadline then
    failwith "DEADLINE_PASSED"
  else () in
  [], storage

type transfer_destination = {
  to_: address;
  token_id: nat;
  amount: nat;
}

type transfer = {
  from_: address;
  txs: transfer_destination list;
}

// Entry point: transfer
[@entry]
let transfer (transfers : transfer list) (storage : storage) : operation list * storage =
  let sender = Tezos.get_sender() in

  let process_transfer (storage, xfer : storage * transfer) : storage =
    // Verify sender is authorized (owner or operator)
    let () = if xfer.from_ <> sender then
      let key = (xfer.from_, sender) in
      if not Big_map.mem key storage.operators then
        failwith "FA2_NOT_OPERATOR"
      else ()
    else () in

    // Process each transfer destination
    List.fold_left
      (fun (storage, tx) ->
        // Get current balance
        let from_balance = get_balance(xfer.from_, tx.token_id, storage) in

        // Check sufficient balance
        let () = if from_balance < tx.amount then
          failwith "FA2_INSUFFICIENT_BALANCE"
        else () in

        // Update balances
        let storage = set_balance(xfer.from_, tx.token_id,
          abs(from_balance - tx.amount), storage) in
        let to_balance = get_balance(tx.to_, tx.token_id, storage) in
        set_balance(tx.to_, tx.token_id, to_balance + tx.amount, storage))
      storage
      xfer.txs
  in

  let storage = List.fold_left process_transfer storage transfers in
  [], storage

// Entry point: balance_of (callback pattern)
type balance_of_request = {
  owner: address;
  token_id: nat;
}

type balance_of_response = {
  request: balance_of_request;
  balance: nat;
}

[@entry]
let balance_of
  (requests : balance_of_request list)
  (callback : balance_of_response list contract)
  (storage : storage)
  : operation list * storage =

  let responses = List.map
    (fun (req : balance_of_request) ->
      let balance = get_balance(req.owner, req.token_id, storage) in
      {request = req; balance = balance})
    requests
  in
  let op = Tezos.transaction responses 0mutez callback in
  [op], storage

// Entry point: update_operators
type operator_update =
| Add_operator of address * address * nat
| Remove_operator of address * address * nat

[@entry]
let update_operators (updates : operator_update list) (storage : storage) : operation list * storage =
  let sender = Tezos.get_sender() in

  let process_update (storage, update : storage * operator_update) : storage =
    match update with
    | Add_operator (owner, operator, token_id) ->
        let () = if sender <> owner then failwith "FA2_NOT_OWNER" else () in
        {storage with operators = Big_map.add (owner, operator) () storage.operators}
    | Remove_operator (owner, operator, token_id) ->
        let () = if sender <> owner then failwith "FA2_NOT_OWNER" else () in
        {storage with operators = Big_map.remove (owner, operator) storage.operators}
  in

  let storage = List.fold_left process_update storage updates in
  [], storage

let validate_nft_transfer (amount : nat) : unit =
  if amount <> 1n then failwith "FA2_INVALID_AMOUNT" else ()

type token_metadata = {
  token_id: nat;
  token_info: (string, bytes) map;
}

type storage = {
  // ... other fields
  token_metadata: (nat, token_metadata) big_map;
  metadata: (string, bytes) big_map;
}

// Off-chain view for token metadata
[@view]
let token_metadata (token_id : nat) (storage : storage) : token_metadata =
  match Big_map.find_opt token_id storage.token_metadata with
  | None -> failwith "FA2_TOKEN_UNDEFINED"
  | Some meta -> meta

// ❌ Expensive - entire map in context
type storage = {
  balances: (address, nat) map;
}

// ✅ Efficient - only accessed entries in context
type storage = {
  balances: (address, nat) big_map;
}

[@view]
let get_balance (owner : address) (storage : storage) : nat =
  match Big_map.find_opt owner storage.balances with
  | None -> 0n
  | Some balance -> balance

// ❌ Expensive - multiple transactions
transfer(alice, 100n);
transfer(bob, 200n);
transfer(charlie, 300n);

// ✅ Efficient - single batched operation
type batch_transfer = {
  recipients: (address * nat) list;
}

[@entry]
let batch_transfer (batch : batch_transfer) (storage : storage) : operation list * storage =
  List.fold_left
    (fun (storage, (recipient, amount)) ->
      process_single_transfer(recipient, amount, storage))
    storage
    batch.recipients

// ❌ Multiple reads of same value
[@entry]
let process (storage : storage) : operation list * storage =
  if storage.config.enabled then
    if storage.config.rate > 0n then
      let result = storage.config.rate * storage.config.multiplier in
      // ... storage.config read 4 times

// ✅ Single read, cached locally
[@entry]
let process (storage : storage) : operation list * storage =
  let config = storage.config in
  if config.enabled then
    if config.rate > 0n then
      let result = config.rate * config.multiplier in
      // ... config accessed from local variable

// Store complex data efficiently
[@entry]
let store_data (data : complex_type) (storage : storage) : operation list * storage =
  let packed = Bytes.pack data in
  {storage with packed_data = Big_map.add key packed storage.packed_data}

[@view]
let retrieve_data (key : string) (storage : storage) : complex_type =
  match Big_map.find_opt key storage.packed_data with
  | None -> failwith "NOT_FOUND"
  | Some packed ->
      match Bytes.unpack packed with
      | None -> failwith "UNPACK_FAILED"
      | Some data -> data