Smart contracts you can read

What the excerpt shows

This is the settlement path of the escrow template, abridged from the real 215-line contract. Three habits every template shares are visible right here:

• Never trust a caller-supplied amount. The contract reads its own on-chain balance and settles the whole of it, so nothing can be stranded or under-paid.
• State is explicit. The escrow marks itself terminal before it pays, so a second call finds a settled contract, not a second payout.
• The ledger is out of reach. The contract cannot credit a balance; it emits a SEND, and the same validated handler that checks every user transaction checks this one.

Every template's README walks through its custody model the same way, and closes with the attacks it was written to survive.

// escrow.js (abridged): pay the seller. The buyer can release,
// or the arbiter can, to settle a dispute.
release: function (xchain) {
    settle(xchain, ['buyer', 'arbiter'], 'seller', 'RELEASED');
},

function settle(xchain, allowedRoles, payeeRole, terminalStatus) {
    xchain.require(xchain.state.get('status') === 'FUNDED',
        'escrow not funded / already settled');

    // Only the roles fixed at deploy time may settle.
    var caller = xchain.getSourceAddress();
    var ok = isAllowed(caller, allowedRoles);
    xchain.require(ok, 'not authorized');

    // Never trust a caller-supplied amount: read the chain.
    var tick = xchain.state.get('tick');
    var addr = xchain.getContractAddress();
    var held = xchain.getBalance(addr, tick);
    xchain.require(xchain.math.gt(held, '0'), 'nothing to settle');

    // Mark terminal BEFORE paying: no second payout.
    xchain.state.set('status', terminalStatus);

    // The contract can't touch the ledger. It emits a validated SEND,
    // checked by the same handlers as every user transaction.
    xchain.emit.send({
        destination: xchain.state.get(payeeRole),
        tick: tick,
        quantity: held
    });
}