Auditor's Handbook: Dissecting the Security Layers of Clarity

Introduction

Clarity is a decidable smart contract language designed for the Stacks blockchain. Unlike Solidity, Clarity is interpreted (not compiled) and intentionally non-Turing complete. This design philosophy has significant implications for security.

The Decidability Advantage

Clarity's decidability means that the behavior of a contract can be fully analyzed before execution. This eliminates entire classes of vulnerabilities that plague Solidity contracts.

No Reentrancy by Design

One of Clarity's most significant security advantages is the complete elimination of reentrancy vulnerabilities. The language simply does not allow the patterns that enable reentrancy attacks.

;; Clarity - Reentrancy impossible
(define-public (transfer (amount uint) (recipient principal))
  (begin
    ;; State change happens atomically
    (try! (stx-transfer? amount tx-sender recipient))
    (ok true)
  )
)

// Solidity - Classic reentrancy vulnerability
function withdraw(uint amount) public {
    require(balances[msg.sender] >= amount);
    // External call before state update - VULNERABLE
    (bool success, ) = msg.sender.call{value: amount}("");
    require(success);
    balances[msg.sender] -= amount;
}

Security Comparison