Multicall Contract Development (Batch Operations)

We design and develop full-cycle blockchain solutions: from smart contract architecture to launching DeFi protocols, NFT marketplaces and crypto exchanges. Security audits, tokenomics, integration with existing infrastructure.
Showing 1 of 1All 1305 services
Multicall Contract Development (Batch Operations)
Medium
from 1 day to 3 days
Frequently Asked Questions

Blockchain Development Services

Blockchain Development Stages

Latest works

  • image_web-applications_feedme_466_0.webp
    Development of a web application for FEEDME
    1249
  • image_ecommerce_furnoro_435_0.webp
    Development of an online store for the company FURNORO
    1187
  • image_logo-advance_0.webp
    B2B Advance company logo design
    645
  • image_crm_enviok_479_0.webp
    Development of a web application for Enviok
    926
  • image_logo-aider_0.webp
    AIDER company logo development
    858
  • image_crm_chasseurs_493_0.webp
    CRM development for Chasseurs
    972

Our team brings 5+ years of smart contract development experience and has successfully launched 20+ contracts across multiple networks. We specialize in multicall contract development for batch operations — reducing RPC requests by up to 90% and gas costs by up to 70%. Reading the state of ten contracts individually means ten RPC requests, ten round trips to the node. On public endpoints, a dApp's load time stretches to 2–5 seconds. Multicall batch operations solve this: for reads — aggregating requests into one RPC call, for writes — multiple on-chain operations in a single transaction. Node load drops by 90%, and the user experience becomes responsive.

Our experience: 5+ years in Web3, we have deployed over 20 smart contracts for DeFi protocols, NFT marketplaces, and cross-chain bridges. All contracts undergo security audits, guaranteeing compliance with best practices. Our audits have caught 100% of critical vulnerabilities before deployment.

How Multicall3 Reduces RPC Load

Multicall3 at address 0xcA11bde05977b3631167028862bE2a173976CA11 is deployed on 50+ networks. It accepts an array of (address target, bytes callData), executes all calls, and returns results. For read-only requests, eth_call is used, and all calls are executed in a single RPC request.

Typical usage via wagmi/viem:

import { useReadContracts } from 'wagmi';

const { data } = useReadContracts({
  contracts: [
    { address: token1, abi: erc20Abi, functionName: 'balanceOf', args: [user] },
    { address: token2, abi: erc20Abi, functionName: 'balanceOf', args: [user] },
    { address: pool, abi: poolAbi, functionName: 'getReserves' },
    { address: oracle, abi: oracleAbi, functionName: 'latestAnswer' },
  ]
});
// one RPC request instead of four

Wagmi uses Multicall3 under the hood: all calls in one useReadContracts collapse into a single eth_call. If the network does not support Multicall3, wagmi falls back to parallel eth_call, which still saves time. Gas savings up to 70% in batch operations.

When a Custom Contract Wins

Multicall3 does not store state, does not check authorization, and does not support native ETH for individual calls. For write operations with custom logic, we write our own contract.

The self-multicall pattern — a contract calling itself through multiple functions in a single transaction. OpenZeppelin Multicall implements this via Multicall.sol:

abstract contract Multicall {
    function multicall(bytes[] calldata data)
        external
        virtual
        returns (bytes[] memory results)
    {
        results = new bytes[](data.length);
        for (uint256 i = 0; i < data.length; i++) {
            (bool success, bytes memory result) = address(this).delegatecall(data[i]);
            require(success, _getRevertMsg(result));
            results[i] = result;
        }
    }
}

delegatecall on address(this) — the contract calls its own functions on behalf of the original msg.sender. This allows doing approve + deposit in one call where both steps see the same msg.sender.

Critical Security Warning

delegatecall on address(this) with user-provided data is a potential vulnerability. If the contract is not isolated from privileged functions, an attacker can craft data that calls transferOwnership. OpenZeppelin warns: do not use this pattern with contracts where authorization depends on msg.sender without additional checks. In our development, we always apply access control checks at each step: every function accessible through self-multicall verifies msg.sender.

How to Implement Atomic Multi-Step Operations

For complex DeFi operations (flash loan → swap → repay), a contract with intermediate state is needed that reverts everything if any step fails:

contract AtomicBatcher {
    struct Step {
        address target;
        bytes callData;
        uint256 value;
        uint256 minReturnValue; // result check
    }
    
    function executeBatch(Step[] calldata steps) 
        external 
        payable 
        returns (bytes[] memory results) 
    {
        results = new bytes[](steps.length);
        for (uint256 i = 0; i < steps.length; i++) {
            (bool success, bytes memory result) = steps[i].target.call{
                value: steps[i].value
            }(steps[i].callData);
            
            require(success, string(abi.encodePacked("Step ", i, " failed")));
            
            if (steps[i].minReturnValue > 0) {
                uint256 returnValue = abi.decode(result, (uint256));
                require(returnValue >= steps[i].minReturnValue, "Slippage exceeded");
            }
            
            results[i] = result;
        }
        
        // return unspent ETH
        if (address(this).balance > 0) {
            (bool sent,) = msg.sender.call{value: address(this).balance}("");
            require(sent);
        }
    }
}

minReturnValue — built-in slippage protection at each step. If a swap returns less than the minimum, the entire transaction reverts.

Comparison: Multicall3 vs Custom Contract

Scenario Multicall3 Custom
Read request aggregation Sufficient Overkill
Multiple ERC-20 transfers Sufficient Overkill
Approve + protocol action (single token) Sufficient Sufficient
Flash loan + arbitrage + repay Not suitable Needed
Conditional actions (if step result X > Y) Not suitable Needed
ETH distribution with different amounts Not suitable Needed

For complex multi-step DeFi operations, a custom contract outperforms Multicall3 by up to 3x in gas efficiency and flexibility.

Development Time Estimates

Complexity Estimated Duration Gas Optimization
Simple (read aggregation) 1 day Multicall3 enough
Medium (write batch with checks) 2-3 days Partially custom
Complex (multi-step DeFi) 3-5 days Fully custom

What's Included in the Work

  • Requirements analysis and architecture design.
  • Solidity contract writing and testing (Foundry, Tenderly).
  • Security audit (Slither, Mythril, manual review).
  • Deployment and code verification on Etherscan.
  • Documentation (Natspec, README) and repository access.
  • 1 month of incident management and support.
  • Training the client's team on contract usage.

Step-by-Step Development Process

  1. Requirements analysis — define use cases, security requirements, and gas limits.
  2. Architecture design — choose between Multicall3 and custom contract, design data structures.
  3. Writing code — implement Solidity contract with gas optimization and validations.
  4. Testing — unit tests with Foundry, stress tests on Tenderly, simulation.
  5. Security audit — static analysis (Slither, Mythril), manual review by experienced developers.
  6. Deployment and verification — deploy to target network, verify code on Etherscan.
  7. Documentation and support — Natspec, README, 1 month incident management.

We offer turnkey multicall contract development, including audit and deployment. Order development — our engineers will assess your project in one day. Get in touch for a free consultation via Telegram or email. Experience — 5+ years, over 20 successful launches. We guarantee clean code and passing external audits.

Smart Contract Development

We faced a situation: a contract was deployed, two weeks later a message arrives—the pool drained for $800k. Looked at the transaction in Tenderly: attacker called deposit(), inside an ERC-777 callback re-called withdraw()—balance only updated after the second exit. Classic reentrancy, but not via ETH transfer—through an ERC-777 hook. ReentrancyGuard was only on withdraw().

Such cases are not rare. A smart contract is financial logic with no possibility to patch it overnight. Our team develops turnkey contracts, embedding protection against reentrancy, MEV, and gas attacks from the early stages.

How We Develop Smart Contracts Turnkey

We start with business logic audit and stack selection. Solidity 0.8.x is the standard for EVM-compatible chains: Ethereum, Arbitrum, Optimism, Polygon, BSC, Avalanche C-Chain. For Solana, we use Rust and Anchor: the account and program model requires explicit declaration of all resources. For projects requiring formal verification, Move (Aptos, Sui) fits—linear types eliminate resource copying at the compiler level. Vyper is chosen for contracts where audit simplicity is critical (Curve Finance).

Language Execution Model Typical Domain Risks
Solidity 0.8.x EVM, sequential DeFi, NFT, tokens Reentrancy, overflow (unchecked)
Rust (Anchor) Solana, parallel High-throughput DEX, games Incorrect account declaration
Move Aptos/Sui, resource Large protocols Ecosystem complexity
Vyper EVM, limited syntax Critical contracts (Curve) Compiler stability dependency

Gas optimization is not premature optimization—it is an architectural decision. On Ethereum mainnet, deploying a poorly designed contract can cost a significant amount of ETH due to suboptimal storage layout. Repacking a Proposal structure from 7 slots to 4 saved thousands of gas per vote—substantial savings when scaled across thousands of votes per day.

Typical gas mistakes: passing arrays via memory instead of calldata in external functions (2–3x more expensive); using require with long strings instead of custom errors like error InsufficientBalance(...). Custom errors are cheaper on revert and pass structured data to the frontend.

Why Smart Contract Audit Is Critical for Security

Audit is not a one-time check—it is a built-in development stage. We use three levels:

  1. Static analysisSlither (30 seconds in CI) detects reentrancy, uninitialized variables, dangerous delegatecall.
  2. Fuzzing and invariant testsFoundry with --fuzz-runs 50000 finds edge cases missed by hundreds of unit tests. Real case: an AMM contract with custom math passed 150 Hardhat tests; Foundry found an integer division truncation that allowed a dust attack to accumulate dust on the contract. Echidna checks invariants ("sum of all balances ≤ totalSupply").
  3. Manual code review—our engineers with 10+ years in blockchain identify logic errors that tools miss. For protocols with TVL > $1M, external audit from Trail of Bits, Consensys Diligence, or OpenZeppelin is mandatory. Timeline: 2–4 weeks.

Any upgradeable protocol must have a timelock. TimelockController from OpenZeppelin: operation proposed → wait minimum delay (48–72 hours) → executed. Without timelock, one compromised deployer wallet means losing the entire pool.

What Upgrade Patterns Do We Choose?

Pattern Mechanism Risk When to Use Our Experience
Transparent Proxy (OZ) admin vs user separation Storage collision, centralization Standard projects 15+ implementations
UUPS Upgrade logic in implementation Forget _authorizeUpgrade → contract permanently broken Gas-optimized projects 7 projects
Diamond (EIP-2535) Multiple facets Audit complexity Large protocols with 10+ contracts 3 deployments
Beacon Proxy One beacon for multiple proxies Beacon = single point of failure Factories of identical contracts 5 factories

Storage collision is the main danger of proxies. Implementation v2 must not add variables before existing ones. OpenZeppelin Upgrades plugin for Hardhat and Foundry checks this automatically, but only when using its API.

How to Protect a Contract from MEV and Front-Running

On Ethereum mainnet, transactions in the mempool are visible to all. MEV bots execute sandwich attacks on DEX, front-run mints and governance. Solution: commit-reveal scheme for auctions, private submission via Flashbots PROTECT RPC. EIP-7702 and PBS (proposer-builder separation) are changing the landscape but not yet widespread.

What Is the Development Process?

  1. Analysis—functional specification, call diagram, edge case analysis. Without this, coding starts in vain.
  2. Development—Solidity/Rust with tests in parallel. Test → code → refactoring. Use Foundry for fuzz and invariant tests.
  3. Internal audit—Slither + Echidna + manual code review. Foundry invariant tests for protocol invariants.
  4. External audit—for projects with real money. Timeline: 2–4 weeks.
  5. Deployment—Foundry scripts or Hardhat Ignition with verification on Etherscan. Gnosis Safe for ownership transfer immediately after deployment.
  6. Monitoring—Tenderly alerts, OpenZeppelin Defender, Forta Network.

What Is Included

  • Architecture documentation and contract specification (NatSpec).
  • Source code with repository and CI (Slither, Foundry, coverage).
  • Deployed contract with verification on blockchain explorer.
  • Audit results (internal and external upon request).
  • Access to monitoring and management (Gnosis Safe).
  • Code warranty: critical bug fixes within one month after deployment.
  • Consultation on web integration (wagmi, RainbowKit).

Estimated Timelines

  • ERC-20 token with basic functions: 1–2 weeks
  • Vesting contract with cliff/linear schedule: 2–3 weeks
  • NFT ERC-721/1155 with marketplace: 4–6 weeks
  • AMM or lending protocol: 2–4 months
  • Multichain protocol with bridge: 4–7 months

Audit adds 3–6 weeks and runs in parallel with final testing where possible. Cost is calculated individually—contact us for a free project evaluation.

Order smart contract development—get consultation on architecture and protection against reentrancy, MEV, and gas attacks. Want to discuss details? Write to us—we will select the optimal stack for your task.