2.10 Solidity Typing

Solidity is a statically typed language, which means that the type of the variables used within the contracts written in Solidity needs to be specified in the code explicitly at compile time. This applies both to state variables and local variables.

Statically typed languages perform what is known as compile time type checking according to the language rules. So when variables of different types are assigned to each other at compile time, the language can enforce that the types are used correctly across all these assignments and usages. Many of the programming languages that you may be familiar with such as C, C++, Java, Rust, Go or Scala are statically typed languages. From a security perspective, the type checking is a critical part and helps in improving the security of the contracts.

Types

Solidity has two categories of types:

• value: they're always passed by value, which means that whenever they are used as function arguments or in assignments of expressions, they are always copied from one location to the other.

• reference: they can be modified via multiple names all of which point to or reference the same underlying variable (i.e. the same memory address; this is easier to understand when it is thought like the concept of pointers).

From a security perspective you can imagine that this becomes important because it affects which state is being updated and what those transitions are in the states as affected by the transactions.

Value Types

As discussed value type is one of the two types in Solidity where variables of these value types are passed by value (which means they are copied when used as function arguments or in assignments of expressions).

There are different value types in Solidity: booleans, integers, fixed point numbers, address, contract, fixed size byte arrays, literals, enums and functions themselves.

From a security perspective, value types can be thought of as being somewhat safer because a copy of that variable is made so that the original value of the original state itself is not modified accidentally. But then one should also check that any assumptions around the persistence of the values is being considered properly, so this will become clearer once we talk about the reference types and once we look at some of the security aspects.

Reference Types

In contrast to value types, reference types are passed by reference: there can be multiple names for the variable, all pointing to the same underlying variable state. There are 3 reference types in Solidity: arrays, structs and mappings.

From a security perspective, reference types can perhaps be considered a little more riskier than value types because now you have multiple names pointing to the same underlying variable, which could, in some situations, lead to unintentional modification of the underlying state.