struct Identity {
    string name;        // ❌ On-chain, visible to all
    uint256 age;        // ❌ PII exposed
    string idNumber;    // ❌ Searchable
}

// Anyone can read:
function getIdentity(address user) public view returns (Identity) {
    return identities[user];  // Alice's full KYC data visible!
}

// Current: Only credential existence
function hasValidCredential(address user, uint8 credType)
    public view returns (bool)
{
    // Returns: true/false
    // Hidden: HOW you proved KYC (manual review, docs, etc.)
}

// FUTURE: Prove attributes without identity
function verifyAttribute(
    bytes calldata zkProof,
    bytes calldata publicSignals
) public returns (bool) {
    // User proves: "I am ≥18 years old AND KYC passed"
    // Without revealing: name, age, ID, nationality, etc.

    // Verifier only checks: "This proof is cryptographically valid"
    // Result: No PII, just "attribute verified"
}

// Verifier contract (on-chain)
pragma solidity 0.8.20;

interface IZKVerifier {
    function verifyProof(
        bytes calldata proof,
        uint256[] calldata publicSignals
    ) external view returns (bool);
}

contract AgeGate {
    IZKVerifier public zkVerifier;

    // Once verified, can access restricted functions
    mapping(bytes32 => bool) public verifiedProofs;

    function verifyAge(
        bytes calldata proof,
        uint256[] calldata publicSignals
    ) external {
        // Verify the ZK proof
        require(
            zkVerifier.verifyProof(proof, publicSignals),
            "Invalid ZK proof"
        );

        // Extract public signals
        bytes32 ageCommitment = bytes32(publicSignals[0]);
        uint256 isOfAge = publicSignals[1];

        require(isOfAge == 1, "Must be 18+");

        // Mark proof as used (prevent replay)
        verifiedProofs[ageCommitment] = true;

        // User can now access age-restricted features
        // without ever revealing birthdate!
    }

    modifier onlyAgeVerified(bytes32 ageCommitment) {
        require(verifiedProofs[ageCommitment], "Not verified");
        _;
    }
}

// VULNERABLE pattern
function withdraw(uint amount) external {
    require(balance[msg.sender] >= amount);

    // ❌ State not updated yet!
    (bool success, ) = msg.sender.call{value: amount}("");

    // ⚠️ If msg.sender is contract, it runs code here
    // Attacker's contract calls withdraw() again
    // Still sees old balance, steals funds again!

    balance[msg.sender] -= amount;  // Too late!
}

function registerIdentity(bytes32 commitmentHash)
    external nonReentrant
{
    // No external calls
    // No reentrancy vector!

    identities[msg.sender] = Identity({...});
    commitmentToAddress[commitmentHash] = msg.sender;
}

function attestIdentity(address user, uint256 expiryDays)
    external nonReentrant
{
    // ✓ Validation checks run first (checks)
    require(identities[user].commitmentHash != bytes32(0));

    // ✓ State updated (effects)
    identities[user].issuer = msg.sender;
    identities[user].issuedAt = block.timestamp;
    identities[user].expiresAt = block.timestamp + (expiryDays * 1 days);

    // ✓ No interactions (no external calls)

    // ✓ Event emitted after state update (good practice)
    emit IdentityAttested(user, msg.sender, expiresAt);
}

function issueCredential(
    address user,
    uint8 credentialType,
    bytes32 credentialHash,
    uint256 expiryDays
)
    external nonReentrant
{
    // ✓ Validation (checks)
    require(!issuers[msg.sender] == false);

    // ✓ Storage update (effects)
    credentials[user][CredentialType(credentialType)] = Credential({
        credentialHash: credentialHash,
        issuedAt: block.timestamp,
        expiresAt: block.timestamp + (expiryDays * 1 days),
        revoked: false
    });

    // ✓ No external calls (no interactions)
    emit CredentialIssued(user, credentialType, expiresAt);
}

function whitelistDeposit()
    external payable nonReentrant onlyKYCPassed
{
    // ✓ Validation (checks)
    require(msg.value > 0);

    // ✓ State update FIRST (effects)
    deposits[msg.sender] += msg.value;
    totalDeposits += msg.value;

    // ✓ No external calls (interactions)

    emit DepositWhitelisted(msg.sender, msg.value);
}

// ❌ BAD (reentrancy vulnerable)
function whitelistWithdraw_bad(uint256 amount)
    external
    onlyKYCPassed
{
    require(deposits[msg.sender] >= amount);

    // Interaction: LOW-LEVEL CALL (attacker hook point!)
    (bool success, ) = msg.sender.call{value: amount}("");
    require(success);

    // ❌ State updated AFTER external call!
    // Attacker's contract receives control here
    // Can call withdrawAgain -> still sees old balance!
    deposits[msg.sender] -= amount;
}

// Attacker contract
contract Attacker {
    AccessGate gate;

    function attack() external {
        gate.whitelistWithdraw(1 ether);  // First call
    }

    // Fallback is called when receiving ETH
    fallback() external payable {
        if (gate.getBalance(address(this)) > 0) {
            gate.whitelistWithdraw(1 ether);  // Recursive call!
            // Balance still shows 2 ether, not 1!
        }
    }
}

function whitelistWithdraw(uint256 amount)
    external
    nonReentrant
    onlyKYCPassed
{
    // ✓ CHECKS: Validate inputs
    require(amount > 0, "Withdrawal must be > 0");
    require(deposits[msg.sender] >= amount, "Insufficient balance");

    // ✓ EFFECTS: Update state FIRST
    deposits[msg.sender] -= amount;    // Deduct BEFORE sending!
    totalDeposits -= amount;

    // ✓ INTERACTIONS: External calls LAST
    (bool success, ) = msg.sender.call{value: amount}("");
    require(success, "Withdrawal failed");

    // ✓ Event last
    emit WithdrawalExecuted(msg.sender, amount);
}

// Attacker tries to re-enter
call withdraw() -> 1st time
  └─> update state (deposits[attacker] -= 1 eth)
  └─> call {value: 1 eth}
      └─> attacker's fallback calls withdraw() -> 2nd time
          └─> nonReentrant guard blocks it!
              Error: ReentrancyGuard: reentrant call

// HYPOTHETICAL FUTURE FEATURE (not in current code)
function attestBySignature(
    address user,
    uint256 expiryDays,
    bytes memory signature
) external {
    // Verify issuer signed this transaction
    address issuer = recoverSigner(signature);
    require(issuers[issuer]);

    // ❌ Potential vector: untrusted token callback
    // If ERC777 or callback-enabled token involved
    token.transferFrom(issuer, address(this), fee);  // Could reentrancy

    // ✓ Fix: Always use nonReentrant + CEI pattern
}

// Old way (inefficient)
require(msg.sender == owner, "Only owner");  // String in bytecode

// New way (efficient + better errors)
if (msg.sender != owner) revert NotOwner();  // Error selector only

// Benefits:
// ✓ Smaller bytecode
// ✓ Cheaper reverts
// ✓ Clear error semantics
// ✓ Better debugging

if (user == address(0)) revert ZeroAddressNotAllowed();
if (!issuers[msg.sender]) revert NotAnIssuer();
if (credentialType > 2) revert InvalidCredentialType();

// Track all state changes with events
emit IdentityRegistered(user, commitmentHash, block.timestamp);
emit IdentityAttested(user, issuer, expiresAt);
emit CredentialIssued(user, credType, expiresAt);

// Benefits:
// ✓ Off-chain monitoring
// ✓ Audit trail
// ✓ Replay attack detection