Securing smart contracts remains a fundamental challenge. At its core, it is a question of building software that is secure in composition with untrusted code, which extends far beyond the blockchain setting. We introduce SCIF, a language for building smart contracts that are compositionally secure. SCIF is based on the fundamentally compositional principle of secure information flow, but extends this core mechanism to be the first language to include protection against reentrancy attacks, confused deputy attacks, and improper error handling, even in the presence of malicious contracts that do not follow the rules of SCIF. SCIF proposes a novel and principled way to understand and prevent reentrancy attacks and confused deputy attacks. Additionally, SCIF supports a rich ecosystem of interacting principals with partial trust through its mechanisms for dynamic trust management. SCIF has been implemented as a compiler to Solidity. We describe the SCIF language, including its static checking rules and its runtime system. Finally, we implement several applications requiring intricate security reasoning, showing how SCIF supports building complex smart contracts securely and provides the programmer with accurate diagnostics about potential security bugs.