Reading Solidity for Non-Programmers

What you'll learn

• Why You Should Be Able to Read a Contract
• Reading a Contract on Etherscan
• Common Patterns: Constructor, Modifier, Mapping, Event
• Red Flags: Backdoors, Owner Mints, Unbounded Loops, Dangerous Transfers
• Walkthrough: Uniswap V2 Router (Safe Contract)
• Walkthrough: The DAO 2016 (Exploited Contract)
• Free Tools: Tenderly, OpenZeppelin Defender, Phalcon, Etherscan Simulator
• For Deeper Reading

Key terms

Etherscan verified contract

A contract whose source code has been published and matched against the deployed bytecode by Etherscan. Indicated by a green checkmark. Unverified contracts hide their behavior and are a red flag for non-trivial interactions.

Read Contract / Write Contract tabs

Etherscan UI sections that let you call view functions (Read) or send transactions (Write) directly through the explorer. Useful for sanity-checking state without signing transactions.

Constructor

Solidity function that runs once when a contract is deployed and never again. Sets initial state. Replaced by initialize() in upgradeable contracts.

Modifier

Reusable Solidity check applied to functions, e.g., onlyOwner. Common modifiers: onlyOwner, nonReentrant, whenNotPaused. Look for them on functions that change critical state.

Mapping

Solidity hash table from key to value. Used for balances (mapping(address => uint256)), allowances (mapping(address => mapping(address => uint256))), and many other lookups.

Event

Solidity log entry emitted to the transaction record. Does not modify state. Indexed parameters can be filtered. Wallets and Etherscan use events to display transaction history.

Reentrancy

Vulnerability where an external call allows a malicious contract to re-enter the calling function before its state is updated. Exploited in the DAO hack (June 2016, $60M); still seen in modern hacks (Cream $130M Oct 2021).

Checks-Effects-Interactions pattern

Best-practice ordering inside a function: validate inputs (checks), update state (effects), then make external calls (interactions). Prevents reentrancy by design.

Owner mint function

Function callable by the contract owner that creates new tokens. Sometimes legitimate (LSTs, stablecoins) but often a rug-pull capability. Always check what address holds owner rights.

Tenderly

Smart contract simulation and observability platform at tenderly.co. Free tier includes a transaction simulator that runs unsigned transactions against current chain state to predict behavior.

Phalcon by BlockSec

Security-focused transaction explainer at explorer.phalcon.xyz. Traces execution, identifies token flows, and flags suspicious patterns. Free for individual transaction analysis.

OpenZeppelin Defender

Smart contract management platform at defender.openzeppelin.com. Provides Sentinels (event monitors), Admin (multisig UI), and Autotasks (scripted automations). Free tier available.