onflow Cadence Language Guide
Write secure, correct Cadence code by following these rules. Cadence uses resource-oriented programming, capability-based security, and explicit access control.
Key Principles
- Secure by default — start with
access(self), expand only when needed - Resource safety — resources exist in one place, must be explicitly moved (
<-) or destroyed - Capability-based security — access delegated through unforgeable, revocable capabilities
- Explicit over implicit — force developers to make security decisions
- Document generated code — follow the Cadence documentation conventions in the relevant reference docs
- Fail with a message — never force-unwrap; bind the optional or
?? panic("…")with what went wrong - Precision is a design decision — arithmetic is checked and division truncates, so pick the type and the operand order deliberately
Navigation Map
Read the relevant reference file based on your task:
| Task | Reference |
|---|---|
| Import patterns, flow.json setup | imports.md |
| Resource lifecycle, move operator | resources.md |
| Contract structure, init, deployment | contracts.md |
| Transaction phases, entitlements | transactions.md |
| Documentation conventions | documentation.md |
| Interfaces, intersection types | interfaces.md |
| Account storage, keys, capabilities | accounts.md |
| References, authorized refs | references.md |
| Access modifiers, visibility rules | access-control.md |
| Entitlements, mappings, Identity, sets | entitlements.md |
| Capabilities, security model | capabilities.md |
Pre/post conditions, before() |
conditions.md |
| Security best practices | security-best-practices.md |
| Anti-patterns to avoid | anti-patterns.md |
| Design patterns | design-patterns.md |
Naming, optionals, let/var, string templates |
style.md |
| Fixed-point precision, checked arithmetic | numerics.md |
| Gotchas versus other languages | language-facts.md |
Read style.md and language-facts.md whenever writing or editing Cadence —
they carry the rules most often missed.
For security-sensitive tasks, also read security-best-practices.md and anti-patterns.md;
for contracts that hold or price value, add numerics.md.
Companion Skills
This skill provides the language foundation. Other skills build on it:
cadence-testing— Use alongside when writing tests for Cadence code. Tests are Cadence too and must follow every rule in this skill.cadence-tokens— Use alongside this skill when building NFT/FT contracts. Token contracts must follow all rules here plus token-specific standards.cadence-audit— Use to verify code follows the security rules and patterns documented here.cadence-scaffold— Use to generate contracts/transactions that follow these rules by default.flow-defi— Use alongside when the contract prices assets, integrates foreign token contracts, or gates a live market.protocol-safety.mdthere carries the oracle, foreign-contract, and emergency-stop rules that sit on top of this skill's security rules.flow-cli— Use to deploy and test the Cadence code written with this skill's guidance.flow-react-sdk— Use when the Cadence scripts/transactions will be called from React hooks.