Defensive coding with contracts