Worked Example · Token + Crowdfunding dApp

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.24;

/// @title RewardToken — a minimal, safe ERC-20 with controlled minting.
/// @notice Balances live in a mapping; "transferring" is just editing two entries.
contract RewardToken {
    string public constant name     = "Campaign Reward";
    string public constant symbol   = "CRS";
    uint8  public constant decimals = 18;          // 1 token = 1e18 base units

    uint256 public totalSupply;
    address public minter;                         // the Crowdfund contract

    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;

    event Transfer(address indexed from, address indexed to, uint256 value);
    event Approval(address indexed owner, address indexed spender, uint256 value);

    error NotMinter();
    error InsufficientBalance();
    error InsufficientAllowance();

    constructor(address minter_) {
        minter = minter_;                          // only this address may mint
    }

    /// @notice Mint new tokens. Restricted to the campaign contract.
    function mint(address to, uint256 amount) external {
        if (msg.sender != minter) revert NotMinter();
        totalSupply += amount;                     // 0.8.x reverts on overflow
        unchecked { balanceOf[to] += amount; }     // safe: bounded by totalSupply
        emit Transfer(address(0), to, amount);     // mint = transfer from the zero address
    }

    /// @notice Move `amount` of your own tokens to `to`.
    function transfer(address to, uint256 amount) external returns (bool) {
        return _transfer(msg.sender, to, amount);
    }

    /// @notice Approve `spender` to pull up to `amount` of your tokens.
    function approve(address spender, uint256 amount) external returns (bool) {
        allowance[msg.sender][spender] = amount;
        emit Approval(msg.sender, spender, amount);
        return true;
    }

    /// @notice Pull `amount` from `from` to `to`, spending the caller's allowance.
    function transferFrom(address from, address to, uint256 amount) external returns (bool) {
        uint256 allowed = allowance[from][msg.sender];
        if (allowed < amount) revert InsufficientAllowance();
        if (allowed != type(uint256).max) {        // infinite approval = no decrement
            allowance[from][msg.sender] = allowed - amount;
        }
        return _transfer(from, to, amount);
    }

    function _transfer(address from, address to, uint256 amount) internal returns (bool) {
        uint256 bal = balanceOf[from];
        if (bal < amount) revert InsufficientBalance();
        unchecked {
            balanceOf[from] = bal - amount;        // safe: checked bal >= amount above
            balanceOf[to]  += amount;              // safe: total supply is the ceiling
        }
        emit Transfer(from, to, amount);
        return true;
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.24;

interface IRewardToken {
    function mint(address to, uint256 amount) external;
}

/// @title Crowdfund — a goal-or-refund escrow that rewards contributors with a token.
contract Crowdfund {
    address public immutable beneficiary;   // who receives funds if the goal is met
    uint256 public immutable goal;          // target in wei
    uint256 public immutable deadline;      // unix timestamp
    IRewardToken public immutable token;    // reward token (this contract is its minter)

    uint256 public totalRaised;
    bool    public withdrawn;               // beneficiary has been paid
    mapping(address => uint256) public contributions;
    mapping(address => bool)    public rewardClaimed;

    // --- re-entrancy guard (the OpenZeppelin nonReentrant pattern) ---
    uint256 private _locked = 1;            // 1 = unlocked, 2 = locked
    modifier nonReentrant() {
        require(_locked == 1, "reentrancy");
        _locked = 2;
        _;
        _locked = 1;
    }

    event Contributed(address indexed who, uint256 amount, uint256 newTotal);
    event Withdrawn(address indexed beneficiary, uint256 amount);
    event Refunded(address indexed who, uint256 amount);
    event RewardClaimed(address indexed who, uint256 tokens);

    modifier campaignOpen() {
        require(block.timestamp < deadline, "campaign ended");
        _;
    }
    modifier campaignEnded() {
        require(block.timestamp >= deadline, "campaign still open");
        _;
    }

    constructor(address beneficiary_, uint256 goalWei, uint256 durationSecs, address token_) {
        require(beneficiary_ != address(0), "zero beneficiary");
        require(goalWei > 0, "zero goal");
        beneficiary = beneficiary_;
        goal        = goalWei;
        deadline    = block.timestamp + durationSecs;
        token       = IRewardToken(token_);
    }

    /// @notice Contribute ETH while the campaign is open.
    function contribute() external payable campaignOpen {
        require(msg.value > 0, "no value");
        contributions[msg.sender] += msg.value;     // effect
        totalRaised               += msg.value;     // effect
        emit Contributed(msg.sender, msg.value, totalRaised);
    }

    /// @notice Beneficiary withdraws once the goal is met (after the deadline).
    function withdraw() external campaignEnded nonReentrant {
        require(msg.sender == beneficiary, "not beneficiary");   // check
        require(totalRaised >= goal, "goal not met");            // check
        require(!withdrawn, "already withdrawn");                // check
        withdrawn = true;                                        // effect (before the call!)
        uint256 amount = address(this).balance;
        (bool ok, ) = beneficiary.call{value: amount}("");       // interaction
        require(ok, "transfer failed");
        emit Withdrawn(beneficiary, amount);
    }

    /// @notice Contributors pull their ETH back if the goal was missed.
    function refund() external campaignEnded nonReentrant {
        require(totalRaised < goal, "goal was met");             // check
        uint256 amount = contributions[msg.sender];              // check
        require(amount > 0, "nothing to refund");                // check
        contributions[msg.sender] = 0;                           // EFFECT before interaction
        (bool ok, ) = msg.sender.call{value: amount}("");        // interaction
        require(ok, "refund failed");
        emit Refunded(msg.sender, amount);
    }

    /// @notice Successful contributors claim reward tokens 1:1 with wei contributed.
    function claimReward() external campaignEnded {
        require(totalRaised >= goal, "campaign failed");         // check
        require(!rewardClaimed[msg.sender], "already claimed");  // check
        uint256 amount = contributions[msg.sender];              // check
        require(amount > 0, "not a contributor");                // check
        rewardClaimed[msg.sender] = true;                        // effect
        token.mint(msg.sender, amount);                          // interaction (trusted token)
        emit RewardClaimed(msg.sender, amount);
    }
}

import { ethers } from "https://cdn.jsdelivr.net/npm/ethers@6.13.0/+esm";

// Minimal ABI — only the members the dApp actually uses.
const CROWDFUND_ABI = [
  "function goal() view returns (uint256)",
  "function deadline() view returns (uint256)",
  "function totalRaised() view returns (uint256)",
  "function contributions(address) view returns (uint256)",
  "function withdrawn() view returns (bool)",
  "function contribute() payable",
  "function withdraw()",
  "function refund()",
  "function claimReward()",
  "event Contributed(address indexed who, uint256 amount, uint256 newTotal)"
];

const CROWDFUND_ADDRESS = "0xYourDeployedCrowdfundAddressHere";

let provider, signer, contract;

// 1) Connect the wallet (EIP-1193 handshake).
async function connect() {
  if (!window.ethereum) { alert("Install MetaMask"); return; }
  provider = new ethers.BrowserProvider(window.ethereum);
  await provider.send("eth_requestAccounts", []);   // prompts the wallet
  signer   = await provider.getSigner();
  contract = new ethers.Contract(CROWDFUND_ADDRESS, CROWDFUND_ABI, signer);
  document.getElementById("addr").textContent = await signer.getAddress();
  await refresh();
  subscribe();
}

// 2) READ — view calls are free and need no signature.
async function refresh() {
  const [goal, raised, deadline, withdrawn] = await Promise.all([
    contract.goal(),
    contract.totalRaised(),
    contract.deadline(),
    contract.withdrawn()
  ]);
  const pct = goal === 0n ? 0 : Number((raised * 100n) / goal);
  document.getElementById("raised").textContent =
    `${ethers.formatEther(raised)} / ${ethers.formatEther(goal)} ETH  (${pct}%)`;
  const ended = BigInt(Math.floor(Date.now() / 1000)) >= deadline;
  document.getElementById("status").textContent =
    withdrawn ? "funded & withdrawn" : ended ? "ended" : "open";
}

// 3) WRITE — send a transaction; the wallet signs, we pay gas, then wait for mining.
async function contribute(ethAmount) {
  const tx = await contract.contribute({ value: ethers.parseEther(ethAmount) });
  document.getElementById("status").textContent = "pending: " + tx.hash;
  const receipt = await tx.wait();                  // 1 confirmation
  console.log("mined in block", receipt.blockNumber, "gas used", receipt.gasUsed);
  await refresh();
}

async function refund()      { await (await contract.refund()).wait();      refresh(); }
async function claimReward() { await (await contract.claimReward()).wait(); refresh(); }

// 4) React to on-chain events in real time (this is why we emit them).
function subscribe() {
  contract.on("Contributed", (who, amount, newTotal) => {
    console.log(`${who} added ${ethers.formatEther(amount)} ETH`);
    refresh();
  });
}

document.getElementById("connect").addEventListener("click", connect);
document.getElementById("give").addEventListener("click", () =>
  contribute(document.getElementById("amount").value)
);

const { ethers } = require("hardhat");

async function main() {
  const [deployer] = await ethers.getSigners();

  // 1) Deploy the token with the deployer as temporary minter.
  const Token = await ethers.getContractFactory("RewardToken");
  const token = await Token.deploy(deployer.address);
  await token.waitForDeployment();

  // 2) Deploy the campaign: goal 10 ETH, 7-day window.
  const goal     = ethers.parseEther("10");
  const duration = 7 * 24 * 60 * 60;
  const Crowdfund = await ethers.getContractFactory("Crowdfund");
  const cf = await Crowdfund.deploy(
    deployer.address, goal, duration, await token.getAddress()
  );
  await cf.waitForDeployment();

  // 3) Hand minting rights to the campaign.
  await (await token.setMinter(await cf.getAddress())).wait();

  console.log("Token:    ", await token.getAddress());
  console.log("Crowdfund:", await cf.getAddress());
}

main().catch((e) => { console.error(e); process.exit(1); });

npm install --save-dev hardhat @nomicfoundation/hardhat-toolbox
npx hardhat test                       # run the unit tests below first
npx hardhat run scripts/deploy.js --network sepolia
npx hardhat verify --network sepolia <address> <constructor args>

const { expect } = require("chai");
const { ethers } = require("hardhat");
const { time } = require("@nomicfoundation/hardhat-network-helpers");

describe("Crowdfund", () => {
  it("refunds contributors when the goal is missed", async () => {
    const [owner, alice] = await ethers.getSigners();
    const Token = await ethers.getContractFactory("RewardToken");
    const token = await Token.deploy(owner.address);
    const Crowdfund = await ethers.getContractFactory("Crowdfund");
    const cf = await Crowdfund.deploy(
      owner.address, ethers.parseEther("10"), 3600, await token.getAddress()
    );

    await cf.connect(alice).contribute({ value: ethers.parseEther("1") });
    await time.increase(3601);                       // jump past the deadline

    await expect(cf.withdraw()).to.be.revertedWith("goal not met");
    await expect(cf.connect(alice).refund())
      .to.emit(cf, "Refunded")
      .withArgs(alice.address, ethers.parseEther("1"));
  });
});

contract Attacker {
    Crowdfund public target;
    constructor(address t) { target = Crowdfund(t); }

    function attack() external payable {
        target.contribute{value: msg.value}();
        target.refund();                       // triggers receive() below
    }
    // The EVM calls this on incoming ETH — the re-entrancy hook.
    receive() external payable {
        if (address(target).balance >= msg.value) {
            target.refund();                   // re-enter BEFORE the first call returns
        }
    }
}