Smart Contract Development

Your complete roadmap to smart contract development: from writing your first ‘Hello World’ contract to deploying production-ready applications on Cosmos EVM.

Smart Contract Development

Master the art of building secure, efficient smart contracts on Cosmos EVM. From your first line of Solidity to production deployment with cross-chain capabilities.

Smart contracts are self-executing programs that run on the blockchain. They automatically enforce agreements without intermediaries, making them perfect for DeFi, governance, and cross-chain applications.

Quick Start

1. Write Your First Contract

   Deploy a simple “Hello World” contract to understand the basics

2. Set Up Development Tools

   Configure Hardhat or Foundry with essential plugins and libraries

3. Test and Deploy

   Write comprehensive tests and deploy to testnet, then mainnet

Your First Contract

Start with a simple contract that demonstrates core concepts:

HelloWorld.sol

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.24;

contract HelloWorld {
    string public message;

    event MessageUpdated(string newMessage, address updatedBy);

    constructor() {
        message = "Hello, Cosmos EVM!";
    }

    function setMessage(string memory newMessage) public {
        message = newMessage;
        emit MessageUpdated(newMessage, msg.sender);
    }
}

Understanding the Code

• State Variable: message stores data permanently on the blockchain
• Constructor: Runs once during deployment to initialize the contract
• Public Function: setMessage allows anyone to update the stored message
• Event: MessageUpdated logs changes for off-chain monitoring
• Gas Costs: Each state change costs gas, paid by the transaction sender

Development Environment

Essential Tools

Visual Studio Code

The most popular IDE for Solidity development. Install the “Hardhat Solidity” extension for syntax highlighting and error detection.

Development Framework

Choose between Hardhat (JavaScript/TypeScript) or Foundry (Solidity-native). Both are excellent—pick based on your background.

OpenZeppelin Contracts

Battle-tested smart contract components. Never reinvent security-critical code when you can use proven libraries.

Quick Setup

Hardhat

# Create new project
mkdir cosmos-evm-project && cd cosmos-evm-project
npm init -y

# Install Hardhat
npm install --save-dev hardhat

# Initialize project
npx hardhat init

# Install OpenZeppelin
npm install @openzeppelin/contracts

# Create new project
mkdir cosmos-evm-project && cd cosmos-evm-project
npm init -y

# Install Hardhat
npm install --save-dev hardhat

# Initialize project
npx hardhat init

# Install OpenZeppelin
npm install @openzeppelin/contracts

# Install Foundry
curl -L https://foundry.paradigm.xyz | bash
foundryup

# Create new project
forge init cosmos-evm-project
cd cosmos-evm-project

# Install dependencies
forge install OpenZeppelin/openzeppelin-contracts

Building a Token Contract

MyToken.sol

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.24;

import "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import "@openzeppelin/contracts/access/Ownable.sol";

contract MyToken is ERC20, Ownable {
    uint256 public constant MAX_SUPPLY = 1000000 * 10**18;

    constructor() ERC20("MyToken", "MTK") Ownable(msg.sender) {
        _mint(msg.sender, MAX_SUPPLY);
    }

    function mint(address to, uint256 amount) public onlyOwner {
        require(totalSupply() + amount <= MAX_SUPPLY, "Exceeds max supply");
        _mint(to, amount);
    }
}

Best Practice: Always use battle-tested libraries like OpenZeppelin for standard functionality. Focus your custom code on unique features.

Security & Best Practices

Core Security Patterns

Input Validation

Always validate inputs to prevent unexpected behavior and attacks

CEI Pattern

Checks-Effects-Interactions prevents reentrancy vulnerabilities

Access Control

Use modifiers and role-based permissions for sensitive functions

Fail-Safe Defaults

Design contracts to fail safely with emergency pause mechanisms

Security Pattern Examples

// Input validation
function transfer(address to, uint256 amount) public {
    require(to != address(0), "Invalid recipient");
    require(amount > 0, "Amount must be positive");
    require(balances[msg.sender] >= amount, "Insufficient balance");
    // ...
}

// Checks-Effects-Interactions pattern
function withdraw(uint256 amount) public {
    // 1. Checks
    require(balances[msg.sender] >= amount, "Insufficient balance");

    // 2. Effects (state changes)
    balances[msg.sender] -= amount;

    // 3. Interactions (external calls)
    (bool success, ) = msg.sender.call{value: amount}("");
    require(success, "Transfer failed");
}

// Access control with modifiers
modifier onlyOwner() {
    require(msg.sender == owner, "Not authorized");
    _;
}

modifier whenNotPaused() {
    require(!paused, "Contract is paused");
    _;
}

Gas Optimization

Storage Optimization

// Efficient struct packing
struct User {
    uint128 balance;      // Slot 1
    uint128 lastUpdate;   // Slot 1 (packed)
    address wallet;       // Slot 2
    bool isActive;        // Slot 2 (packed)
    uint8 tier;          // Slot 2 (packed)
}

// Cache storage reads
function processUser(uint256 userId) public {
    User memory user = users[userId]; // Single SLOAD
    // Use 'user' multiple times without additional storage reads
}

// Efficient struct packing
struct User {
    uint128 balance;      // Slot 1
    uint128 lastUpdate;   // Slot 1 (packed)
    address wallet;       // Slot 2
    bool isActive;        // Slot 2 (packed)
    uint8 tier;          // Slot 2 (packed)
}

// Cache storage reads
function processUser(uint256 userId) public {
    User memory user = users[userId]; // Single SLOAD
    // Use 'user' multiple times without additional storage reads
}

// Efficient batch operations
function batchTransfer(
    address[] calldata recipients,
    uint256[] calldata amounts
) external {
    uint256 length = recipients.length;
    require(length == amounts.length, "Length mismatch");

    for (uint256 i; i < length; ) {
        _transfer(msg.sender, recipients[i], amounts[i]);
        unchecked { ++i; }
    }
}

// Use calldata for read-only arrays
function sum(uint256[] calldata numbers)
    external
    pure
    returns (uint256 total)
{
    for (uint256 i; i < numbers.length; ) {
        total += numbers[i];
        unchecked { ++i; }
    }
}

Gas Optimization Trade-offs: Always balance gas optimization with code readability and security. Premature optimization can introduce bugs.

Testing Strategies

Comprehensive Testing Approach

Unit Tests

Test individual functions in isolation. Start here to catch basic logic errors.

Integration Tests

Test how different contracts work together. Critical for complex systems.

Fuzz Testing

Throw random inputs at your functions to find edge cases you never considered.

Security Tests

Specifically test for common vulnerabilities like reentrancy and overflow attacks.

Testing Examples

Unit Tests

describe("Token Core Functions", function () {
    it("Should handle edge cases", async function () {
        const Token = await ethers.getContractFactory("MyToken");
        const token = await Token.deploy();

        // Test zero amount
        await expect(
            token.transfer(addr1.address, 0)
        ).to.be.revertedWith("Amount must be positive");

        // Test address(0)
        await expect(
            token.transfer(ethers.constants.AddressZero, 100)
        ).to.be.revertedWith("Invalid recipient");
    });
});

describe("Token Core Functions", function () {
    it("Should handle edge cases", async function () {
        const Token = await ethers.getContractFactory("MyToken");
        const token = await Token.deploy();

        // Test zero amount
        await expect(
            token.transfer(addr1.address, 0)
        ).to.be.revertedWith("Amount must be positive");

        // Test address(0)
        await expect(
            token.transfer(ethers.constants.AddressZero, 100)
        ).to.be.revertedWith("Invalid recipient");
    });
});

describe("DeFi Integration", function () {
    it("Should work with DEX", async function () {
        // Deploy token and DEX
        const token = await Token.deploy();
        const dex = await DEX.deploy(token.address);

        // Approve and add liquidity
        await token.approve(dex.address, parseEther("1000"));
        await dex.addLiquidity(parseEther("1000"), {
            value: parseEther("1")
        });

        // Test swap
        const balanceBefore = await token.balanceOf(user.address);
        await dex.swap({ value: parseEther("0.1") });
        const balanceAfter = await token.balanceOf(user.address);

        expect(balanceAfter).to.be.gt(balanceBefore);
    });
});

// Foundry fuzz test
function testFuzz_Transfer(address to, uint256 amount) public {
    // Assume valid inputs
    vm.assume(to != address(0));
    vm.assume(amount <= token.balanceOf(address(this)));

    uint256 balanceBefore = token.balanceOf(to);
    token.transfer(to, amount);

    assertEq(
        token.balanceOf(to),
        balanceBefore + amount
    );
}

Test Coverage Goal: Aim for 100% line coverage, but remember that high coverage doesn’t guarantee bug-free code. Focus on testing edge cases and attack vectors.

Deployment Process

Deployment Pipeline

1. Local Testing

   Run comprehensive test suite on local Hardhat/Anvil network

2. Testnet Deployment

   Deploy to Cosmos EVM testnet for real-world testing

3. Security Audit

   Get professional audit for contracts handling significant value

4. Mainnet Deployment

   Deploy to mainnet with proper monitoring and incident response plan

Network Configuration

hardhat.config.js

require("@nomicfoundation/hardhat-toolbox");
require("dotenv").config();

module.exports = {
  solidity: {
    version: "0.8.24",
    settings: {
      optimizer: {
        enabled: true,
        runs: 200
      }
    }
  },
  networks: {
    cosmosEvmTestnet: {
      url: process.env.TESTNET_RPC_URL,
      accounts: [process.env.PRIVATE_KEY],
      chainId: 9000 // Replace with actual testnet chain ID
    },
    cosmosEvmMainnet: {
      url: process.env.MAINNET_RPC_URL,
      accounts: [process.env.PRIVATE_KEY],
      chainId: 9001 // Replace with actual mainnet chain ID
    }
  },
  etherscan: {
    apiKey: process.env.ETHERSCAN_API_KEY
  }
};

Deployment Scripts

scripts/deploy.js

const hre = require("hardhat");
const { verify } = require("./verify");

async function main() {
    console.log("Deploying contracts...");

    const [deployer] = await ethers.getSigners();
    console.log("Deploying with:", deployer.address);

    // Check balance
    const balance = await deployer.getBalance();
    console.log("Account balance:", ethers.utils.formatEther(balance));

    // Deploy contract
    const Contract = await ethers.getContractFactory("MyToken");
    const contract = await Contract.deploy();
    await contract.deployed();

    console.log("Contract deployed to:", contract.address);
    console.log("Deployment tx:", contract.deployTransaction.hash);

    // Wait for confirmations
    console.log("Waiting for confirmations...");
    await contract.deployTransaction.wait(5);

    // Verify contract
    await verify(contract.address, []);

    // Save deployment info
    const deploymentInfo = {
        address: contract.address,
        txHash: contract.deployTransaction.hash,
        deployer: deployer.address,
        network: hre.network.name,
        timestamp: new Date().toISOString()
    };

    console.log("Deployment complete!", deploymentInfo);
}

main().catch((error) => {
    console.error(error);
    process.exit(1);
});

Pre-Deployment Checklist

Contract Verification

Why Verification Matters

Transparency

Users can read and verify your contract’s source code on block explorers

Trust

Verified contracts build user confidence through code transparency

Integration

Other developers can easily integrate with verified contracts

Debugging

Easier to debug issues with readable source code in production

Verification Methods

Hardhat Verify

// scripts/verify.js
async function verify(address, constructorArgs) {
    console.log("Verifying contract...");
    try {
        await run("verify:verify", {
            address: address,
            constructorArguments: constructorArgs,
        });
        console.log("Contract verified!");
    } catch (e) {
        if (e.message.toLowerCase().includes("already verified")) {
            console.log("Contract already verified!");
        } else {
            console.error(e);
        }
    }
}

module.exports = { verify };

// scripts/verify.js
async function verify(address, constructorArgs) {
    console.log("Verifying contract...");
    try {
        await run("verify:verify", {
            address: address,
            constructorArguments: constructorArgs,
        });
        console.log("Contract verified!");
    } catch (e) {
        if (e.message.toLowerCase().includes("already verified")) {
            console.log("Contract already verified!");
        } else {
            console.error(e);
        }
    }
}

module.exports = { verify };

# Verify with constructor args
forge verify-contract \
    --chain-id 9001 \
    --compiler-version v0.8.24 \
    --constructor-args $(cast abi-encode "constructor()" ) \
    0xYourContractAddress \
    src/MyToken.sol:MyToken \
    $ETHERSCAN_API_KEY

1. Go to the block explorer
2. Find your contract address
3. Click “Verify and Publish”
4. Enter:
   • Compiler version (must match exactly)
   • Optimization settings
   • Source code (flattened)
   • Constructor arguments (ABI encoded)
5. Submit for verification

Complete Example: Governance Contract

Let’s build a production-ready governance contract that demonstrates all concepts:

contracts/Governance.sol

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.24;

import "@openzeppelin/contracts/security/ReentrancyGuard.sol";
import "@openzeppelin/contracts/security/Pausable.sol";
import "@openzeppelin/contracts/access/Ownable.sol";

contract Governance is ReentrancyGuard, Pausable, Ownable {
    struct Proposal {
        string description;
        uint256 forVotes;
        uint256 againstVotes;
        uint256 startTime;
        uint256 endTime;
        bool executed;
        mapping(address => bool) hasVoted;
    }

    uint256 public constant VOTING_PERIOD = 3 days;
    uint256 public constant MIN_QUORUM = 100 * 10**18; // 100 tokens

    mapping(uint256 => Proposal) public proposals;
    uint256 public proposalCount;

    event ProposalCreated(
        uint256 indexed proposalId,
        string description,
        uint256 startTime,
        uint256 endTime
    );

    event VoteCast(
        uint256 indexed proposalId,
        address indexed voter,
        bool support,
        uint256 weight
    );

    event ProposalExecuted(uint256 indexed proposalId);

    constructor() Ownable(msg.sender) {}

    function createProposal(string calldata description)
        external
        whenNotPaused
        returns (uint256)
    {
        uint256 proposalId = proposalCount++;
        Proposal storage proposal = proposals[proposalId];

        proposal.description = description;
        proposal.startTime = block.timestamp;
        proposal.endTime = block.timestamp + VOTING_PERIOD;

        emit ProposalCreated(
            proposalId,
            description,
            proposal.startTime,
            proposal.endTime
        );

        return proposalId;
    }

    function vote(uint256 proposalId, bool support)
        external
        nonReentrant
        whenNotPaused
    {
        Proposal storage proposal = proposals[proposalId];

        require(
            block.timestamp >= proposal.startTime,
            "Voting not started"
        );
        require(
            block.timestamp <= proposal.endTime,
            "Voting ended"
        );
        require(
            !proposal.hasVoted[msg.sender],
            "Already voted"
        );

        uint256 weight = getVotingPower(msg.sender);
        require(weight > 0, "No voting power");

        proposal.hasVoted[msg.sender] = true;

        if (support) {
            proposal.forVotes += weight;
        } else {
            proposal.againstVotes += weight;
        }

        emit VoteCast(proposalId, msg.sender, support, weight);
    }

    function executeProposal(uint256 proposalId)
        external
        nonReentrant
    {
        Proposal storage proposal = proposals[proposalId];

        require(
            block.timestamp > proposal.endTime,
            "Voting still active"
        );
        require(!proposal.executed, "Already executed");
        require(
            proposal.forVotes > proposal.againstVotes,
            "Proposal failed"
        );
        require(
            proposal.forVotes >= MIN_QUORUM,
            "Quorum not reached"
        );

        proposal.executed = true;

        // Execute proposal logic here
        _executeProposal(proposalId);

        emit ProposalExecuted(proposalId);
    }

    function getVotingPower(address voter)
        public
        view
        returns (uint256)
    {
        // Implement your voting power logic
        // Could be based on token balance, NFT ownership, etc.
        return 100 * 10**18; // Placeholder
    }

    function _executeProposal(uint256 proposalId) private {
        // Implement proposal execution logic
    }

    function pause() external onlyOwner {
        _pause();
    }

    function unpause() external onlyOwner {
        _unpause();
    }
}

Key Features Demonstrated

• Security: ReentrancyGuard, Pausable, proper access control
• Gas Optimization: Efficient storage layout, calldata for strings
• Testing: Comprehensive test coverage including edge cases
• Events: Detailed event logging for off-chain monitoring
• Validation: Thorough input validation and state checks
• Modularity: Clean separation of concerns, upgradeable design

Advanced Topics

Next Learning Steps

Upgradeable Contracts

Implement proxy patterns for contract upgradeability while maintaining decentralization

Cross-Chain DApps

Build applications that leverage IBC for seamless cross-chain communication

DeFi Protocols

Create lending, DEX, and yield farming protocols with advanced financial logic

Security Patterns

Master advanced security patterns and formal verification techniques

Cosmos EVM Specific Features

Precompiles

Access native Cosmos SDK modules directly from Solidity:

• Staking: Delegate, undelegate, and claim rewards
• Governance: Create and vote on proposals
• IBC: Send cross-chain messages and tokens
• Bank: Query balances and send native tokens

Access native Cosmos SDK modules directly from Solidity:

• Staking: Delegate, undelegate, and claim rewards
• Governance: Create and vote on proposals
• IBC: Send cross-chain messages and tokens
• Bank: Query balances and send native tokens

// Example: IBC transfer from Solidity
interface IICS20 {
    function transfer(
        string calldata sourcePort,
        string calldata sourceChannel,
        string calldata denom,
        uint256 amount,
        address sender,
        string calldata receiver,
        uint64 timeoutHeight,
        uint64 timeoutTimestamp
    ) external;
}

Resources & Community

Documentation

• Cosmos EVM Docs
• OpenZeppelin Docs
• Solidity Docs

Learning

• Cyfrin Updraft
• Solidity by Example
• Smart Contract Programmer

Community

• Discord Community
• Developer Forum
• GitHub Discussions

Start Building Today: The best way to learn is by doing. Start with simple contracts, iterate quickly, and don’t be afraid to ask for help in the community.