Writing Secure Smart Contracts on Base

Introduction

Building smart contracts on Base, an Ethereum Layer 2 blockchain, is a great way to save gas fees and boost performance. But just like on Layer 1, security is critical. In fact, Layer 2 adds its own challenges. In this article, we will go over the most important smart contract security tips that apply to Base. We will focus on real issues like reentrancy attacks, gas griefing, and L2-specific risks, and show you how to prevent them with examples.

Why Smart Contract Security Matters on Base

Smart contracts are immutable; once deployed, bugs can't be fixed.
Base inherits security from Ethereum, but L2-specific behaviors (like rollups) can affect contract logic.
Vulnerabilities can lead to lost funds, broken apps, or project failure.

Common Security Issues on Base and How to Fix Them

1. Reentrancy Attacks

It is a malicious contract that repeatedly calls your contract before the first function finishes, possibly draining funds.

Example of vulnerable code

function withdraw(uint _amount) public {
    require(balances[msg.sender] >= _amount);
    (bool sent, ) = msg.sender.call{value: _amount}("");
    require(sent, "Transfer failed");
    balances[msg.sender] -= _amount;
}

Problem. The balance is updated after sending Ether.

Fix it (Use Checks-Effects-Interactions pattern)

function withdraw(uint _amount) public {
    require(balances[msg.sender] >= _amount);
    balances[msg.sender] -= _amount;
    (bool sent, ) = msg.sender.call{value: _amount}("");
    require(sent, "Transfer failed");
}

You can also use ReentrancyGuard from OpenZeppelin.

import "@openzeppelin/contracts/security/ReentrancyGuard.sol";

contract SecureContract is ReentrancyGuard {
    function withdraw(uint _amount) public nonReentrant {
        // safe logic
    }
}

2. Gas Griefing

In this, an attacker uses tricks to make your contract run out of gas or break functionality by sending heavy data or interacting in a complex way.

Common Example. Relying on msg.sender.code.length or assuming certain gas costs, which may not hold on Base or in future EVM updates.

Mitigation

Avoid assumptions about gas availability.
Use gasleft() checks when calling untrusted contracts.
Avoid unbounded loops that rely on user input.

Always test your contract under high-load scenarios using tools like Hardhat or Foundry.

3. L2-Specific Risks on Base

Since Base is built on the OP Stack (Optimism), it has some unique security behaviors:

Delayed Finality

Transactions are submitted to Ethereum in batches.
There’s a short delay between submission on Base and final confirmation on Ethereum.

Tip: Don’t rely on Base transaction finality for security-critical logic like DAO voting deadlines or auctions.

Data Availability Assumptions

Rollups store transaction data off-chain and post proofs on Ethereum.
If something breaks off-chain, your app logic could fail unexpectedly.
Mitigation: Use services like EAS (Ethereum Attestation Service) or chain data verifiers to validate assumptions.

Cross-Chain Message Risks

If you are passing messages between Ethereum and Base using bridges

Always validate messages.
Use nonces or unique message IDs to prevent replay attacks.
Be careful of front-running when executing bridged actions.

Security Checklist for Base Smart Contracts

Use the latest Solidity version (^0.8.20 or above)
Use OpenZeppelin's audited contracts
Avoid external calls before updating the state
Use nonReentrant for withdrawal functions
Avoid unbounded loops or large input arrays
Validate user input and length of calldata
Test with edge cases (zero addresses, huge gas, etc.)
Avoid storing critical data off-chain without backups
Use tools like Slither, MythX, or Hardhat's coverage plugin for audits
Use require() messages to help with debugging and error clarity
Consider rate-limiting, role-based access, and timelocks

Practical Testing Example (Using Hardhat)

Sample withdrawal function with security

import "@openzeppelin/contracts/security/ReentrancyGuard.sol";

contract SafeVault is ReentrancyGuard {
    mapping(address => uint) public balances;

    function withdraw(uint _amount) public nonReentrant {
        require(balances[msg.sender] >= _amount, "Insufficient funds");
        balances[msg.sender] -= _amount;
        (bool sent, ) = msg.sender.call{value: _amount}("");
        require(sent, "Transfer failed");
    }

    function deposit() external payable {
        balances[msg.sender] += msg.value;
    }
}

This smart contract defines a simple vault where users can deposit and withdraw Ether.
It uses OpenZeppelin’s ReentrancyGuard to prevent reentrancy attacks, a common security issue.
The deposit function allows users to add Ether to their balance, and the withdraw function lets them safely withdraw funds.
The nonReentrant modifier ensures that the withdraw function cannot be re-entered during execution, protecting the contract from malicious repeated withdrawals.

Test Case Example in Hardhat (JavaScript)

it("should prevent reentrancy", async () => {
  await contract.deposit({ value: ethers.utils.parseEther("1") });
  await expect(contract.withdraw(ethers.utils.parseEther("1"))).to.not.be.reverted;
});

This is a unit test written in JavaScript using Hardhat and Chai for a smart contract. It checks that the withdraw function is not vulnerable to a reentrancy attack.
The test first deposits 1 Ether into the contract using contract.deposit(). Then it tries to withdraw the same amount using contract.withdraw().
The expect(...).to.not.be.reverted line ensures that the transaction completes successfully, confirming that the nonReentrant protection works and no error or vulnerability was triggered during withdrawal.

Compile the Smart Contract

npx hardhat compile

Write the Test File

Create a test file inside the /test folder (e.g., test/SafeVault.js)

const { expect } = require("chai");
const { ethers } = require("hardhat");

describe("SafeVault", function () {
  let contract;
  let owner;

  beforeEach(async () => {
    const [deployer] = await ethers.getSigners();
    const SafeVault = await ethers.getContractFactory("SafeVault");
    contract = await SafeVault.deploy();
    await contract.deployed();
    owner = deployer;
  });

  it("should prevent reentrancy", async () => {
    await contract.deposit({ value: ethers.utils.parseEther("1") });
    await expect(contract.withdraw(ethers.utils.parseEther("1"))).to.not.be.reverted;
  });
});

This file is used to test the smart contract. It first sets up a test environment by deploying the contract and assigning the deployer as the owner. The actual test case, named "should prevent reentrancy", checks if the contract safely handles Ether withdrawals. It deposits 1 Ether into the vault and then tries to withdraw the same amount.
The test uses expect(...).to.not.be.reverted to confirm that the withdraw function executes without any errors, proving that the contract is secure against reentrancy attacks.

Run the Test

npx hardhat test

test output

Conclusion

Writing secure smart contracts on Base is not very different from Ethereum, but you must account for Layer 2 behaviors like rollups, message delays, and data availability. Always follow the best practices, use tested libraries like OpenZeppelin, and write clean, gas-efficient, and bug-free code. A little security now can save you a lot of trouble later.