Security: the exploits that defined the industry

In June 2016 an attacker drained 3.6 million ETH from The DAO, the largest crowdfund in history at the time, using a bug that fits in five lines. The fallout split Ethereum into two chains. The bug is reentrancy, and understanding it is the entry ticket to writing contracts that hold money.

// Vulnerable: sends BEFORE updating the balance
function withdraw() external {
    uint256 amount = balances[msg.sender];
    (bool ok, ) = msg.sender.call{value: amount}("");   // hands control to the caller
    require(ok);
    balances[msg.sender] = 0;                             // too late
}

When the contract sends ETH to another contract, that contract's receive function runs in the middle of withdraw. If the attacker's receive calls withdraw again, the balance has not been zeroed yet, so it pays again. And again, until the vault is empty or gas runs out.

Checks, effects, interactions

The fix is an ordering discipline. Checks first (requires), effects second (write your own state), interactions last (calls to other contracts). Zero the balance before you send, and a re-entrant call finds nothing to take. Belt and braces: a reentrancy guard, a boolean lock set on entry and cleared on exit, which OpenZeppelin ships as nonReentrant.

function withdraw() external nonReentrant {
    uint256 amount = balances[msg.sender];   // check
    balances[msg.sender] = 0;                // effect
    (bool ok, ) = msg.sender.call{value: amount}("");   // interaction
    require(ok);
}

The other two classes

Access control. In 2017 the Parity multisig library had an initWallet function anyone could call; someone called it, became owner, and froze 513,000 ETH forever. Every state-changing function needs a deliberate answer to "who may call this", and the answer must be tested. Oracle manipulation. A lending protocol that prices collateral from a single pool's spot reserves can be tricked: borrow a huge amount, swap to move the price, borrow against the inflated collateral, swap back. Use time-weighted prices or a dedicated oracle network like Chainlink, never one pool's instant ratio.

Next: the shape of a real dApp. Wallets in the browser, reads over RPC, writes through the wallet, and an indexer built from events.