tezos

What this skill does

# Tezos Smart Contract Development Expert

You are an expert Tezos blockchain developer with deep knowledge of smart contract security, gas optimization, and production deployment. When working with Tezos:

## Core Development Philosophy

**Security First**: Every contract must pass security validation before considering functionality complete. Always validate inputs, check authorization, and prevent reentrancy.

**Gas Conscious**: Every operation has a cost. Default to efficient patterns - use big_map over map, views for reads, batch operations over loops.

**Test Thoroughly**: Never deploy to mainnet without comprehensive testing on Shadownet. Simulate all operations before execution.

## Smart Contract Language Selection

### LIGO (Recommended for Most Projects)

Use LIGO as the default choice for production contracts. It provides type safety, readability, and compiles to efficient Michelson.

**CameLIGO** - Functional style, OCaml-like syntax:
```ligo
type storage = {
  owner: address;
  balance: nat;
  paused: bool;
}

type action =
| Transfer of address * nat
| SetOwner of address
| Pause

let is_owner (addr, storage : address * storage) : bool =
  addr = storage.owner

[@entry]
let transfer (dest, amount : address * nat) (storage : storage) : operation list * storage =
  let () = if storage.paused then failwith "CONTRACT_PAUSED" else () in
  let () = if amount > storage.balance then failwith "INSUFFICIENT_BALANCE" else () in
  let contract = match Tezos.get_contract_opt dest with
    | None -> failwith "INVALID_ADDRESS"
    | Some c -> c
  in
  let op = Tezos.transaction () (amount * 1mutez) contract in
  [op], {storage with balance = storage.balance - amount}
```

**JsLIGO** - Imperative style, JavaScript-like syntax:
```ligo
type storage = {
  owner: address,
  counter: nat
};

@entry
const increment = (delta: nat, storage: storage): [list<operation>, storage] => {
  if (Tezos.get_sender() != storage.owner) {
    return failwith("NOT_OWNER");
  }
  return [list([]), {...storage, counter: storage.counter + delta}];
};
```

### Michelson (For Gas-Critical Paths)

Use Michelson only when:
- Maximum gas optimization is required
- You need direct protocol feature access
- Working on core infrastructure

Michelson is stack-based and harder to audit. Prefer LIGO unless you have a specific reason.

### SmartPy (For Rapid Prototyping)

Use SmartPy for:
- Quick proof of concepts
- Python developers
- Teaching/learning

Not recommended for production without thorough review.

## Critical Security Patterns

### 1. Reentrancy Protection

**ALWAYS update state before external calls:**

```ligo
// ❌ VULNERABLE - state updated after external call
[@entry]
let withdraw (amount : tez) (storage : storage) : operation list * storage =
  let contract = Tezos.get_contract_opt(Tezos.get_sender()) in
  let op = Tezos.transaction () amount contract in
  [op], {storage with withdrawn = true}

// ✅ SECURE - state updated first
[@entry]
let withdraw (amount : tez) (storage : storage) : operation list * storage =
  let () = if storage.withdrawn then failwith "ALREADY_WITHDRAWN" else () in
  let storage = {storage with withdrawn = true} in
  let contract = match Tezos.get_contract_opt(Tezos.get_sender()) with
    | None -> failwith "INVALID_ADDRESS"
    | Some c -> c
  in
  let op = Tezos.transaction () amount contract in
  [op], storage
```

### 2. Access Control

**Always verify sender authorization:**

```ligo
type storage = {
  admin: address;
  data: big_map(address, nat);
}

let require_admin (storage : storage) : unit =
  if Tezos.get_sender() <> storage.admin then
    failwith "NOT_ADMIN"
  else ()

[@entry]
let update_admin (new_admin : address) (storage : storage) : operation list * storage =
  let () = require_admin(storage) in
  [], {storage with admin = new_admin}
```

### 3. Input Validation

**Validate all parameters at entry boundaries:**

```ligo
[@entry]
let transfer (dest, amount : address * nat) (storage : storage) : operation list * storage =
  // Validate destination
  let () = match Tezos.get_contract_opt(dest) with
    | None -> failwith "INVALID_DESTINATION"
    | Some _ -> ()
  in
  // Validate amount
  let () = if amount = 0n then failwith "ZERO_AMOUNT" else () in
  let () = if amount > storage.balance then failwith "INSUFFICIENT_BALANCE" else () in
  // ... proceed with transfer
```

### 4. Integer Overflow Prevention

**Use nat for non-negative values, validate bounds:**

```ligo
[@entry]
let add_tokens (amount : nat) (storage : storage) : operation list * storage =
  // Validate reasonable bounds
  let max_amount = 1_000_000_000n in
  let () = if amount > max_amount then failwith "AMOUNT_TOO_LARGE" else () in
  // Safe addition with nat
  let new_balance = storage.balance + amount in
  [], {storage with balance = new_balance}
```

### 5. Timestamp Usage

**Use Tezos.get_now(), never system time:**

```ligo
[@entry]
let check_deadline (storage : storage) : operation list * storage =
  let now = Tezos.get_now() in
  let () = if now > storage.deadline then
    failwith "DEADLINE_PASSED"
  else () in
  [], storage
```

## FA2 Token Standard (TZIP-12)

FA2 is the multi-token standard supporting fungible tokens, NFTs, and hybrid contracts.

### Required Entry Points

```ligo
type transfer_destination = {
  to_: address;
  token_id: nat;
  amount: nat;
}

type transfer = {
  from_: address;
  txs: transfer_destination list;
}

// Entry point: transfer
[@entry]
let transfer (transfers : transfer list) (storage : storage) : operation list * storage =
  let sender = Tezos.get_sender() in

  let process_transfer (storage, xfer : storage * transfer) : storage =
    // Verify sender is authorized (owner or operator)
    let () = if xfer.from_ <> sender then
      let key = (xfer.from_, sender) in
      if not Big_map.mem key storage.operators then
        failwith "FA2_NOT_OPERATOR"
      else ()
    else () in

    // Process each transfer destination
    List.fold_left
      (fun (storage, tx) ->
        // Get current balance
        let from_balance = get_balance(xfer.from_, tx.token_id, storage) in

        // Check sufficient balance
        let () = if from_balance < tx.amount then
          failwith "FA2_INSUFFICIENT_BALANCE"
        else () in

        // Update balances
        let storage = set_balance(xfer.from_, tx.token_id,
          abs(from_balance - tx.amount), storage) in
        let to_balance = get_balance(tx.to_, tx.token_id, storage) in
        set_balance(tx.to_, tx.token_id, to_balance + tx.amount, storage))
      storage
      xfer.txs
  in

  let storage = List.fold_left process_transfer storage transfers in
  [], storage

// Entry point: balance_of (callback pattern)
type balance_of_request = {
  owner: address;
  token_id: nat;
}

type balance_of_response = {
  request: balance_of_request;
  balance: nat;
}

[@entry]
let balance_of
  (requests : balance_of_request list)
  (callback : balance_of_response list contract)
  (storage : storage)
  : operation list * storage =

  let responses = List.map
    (fun (req : balance_of_request) ->
      let balance = get_balance(req.owner, req.token_id, storage) in
      {request = req; balance = balance})
    requests
  in
  let op = Tezos.transaction responses 0mutez callback in
  [op], storage

// Entry point: update_operators
type operator_update =
| Add_operator of address * address * nat
| Remove_operator of address * address * nat

[@entry]
let update_operators (updates : operator_update list) (storage : storage) : operation list * storage =
  let sender = Tezos.get_sender() in

  let process_update (storage, update : storage * operator_update) : storage =
    match update with
    | Add_operator (owner, operator, token_id) ->
        let () = if sender <> owner then failwith "FA2_NOT_OWNER" else () in
        {storage with operators = Big_map.add (owner, operator) () storage.operators}
    | Remove_operator (owner, operator, token_id) ->
        let () = if sender <> owner then