diff options
author | chriseth <chris@ethereum.org> | 2017-11-30 23:08:09 +0800 |
---|---|---|
committer | GitHub <noreply@github.com> | 2017-11-30 23:08:09 +0800 |
commit | c4cbbb054b5ed3b8ceaa21ee5b47b0704762ff40 (patch) | |
tree | 27c068f6cd96513a9023e586c209eb9f01309171 /docs/security-considerations.rst | |
parent | 9cf6e910bd2b90d0c9415d9c257f85fe0c518de8 (diff) | |
parent | d0af0c14841648365ad05ecc626e672a16df5b5c (diff) | |
download | dexon-solidity-c4cbbb054b5ed3b8ceaa21ee5b47b0704762ff40.tar dexon-solidity-c4cbbb054b5ed3b8ceaa21ee5b47b0704762ff40.tar.gz dexon-solidity-c4cbbb054b5ed3b8ceaa21ee5b47b0704762ff40.tar.bz2 dexon-solidity-c4cbbb054b5ed3b8ceaa21ee5b47b0704762ff40.tar.lz dexon-solidity-c4cbbb054b5ed3b8ceaa21ee5b47b0704762ff40.tar.xz dexon-solidity-c4cbbb054b5ed3b8ceaa21ee5b47b0704762ff40.tar.zst dexon-solidity-c4cbbb054b5ed3b8ceaa21ee5b47b0704762ff40.zip |
Merge pull request #3261 from ethereum/develop
Merge develop into release for 0.4.19
Diffstat (limited to 'docs/security-considerations.rst')
-rw-r--r-- | docs/security-considerations.rst | 50 |
1 files changed, 26 insertions, 24 deletions
diff --git a/docs/security-considerations.rst b/docs/security-considerations.rst index 6586cb5f..337a3d3f 100644 --- a/docs/security-considerations.rst +++ b/docs/security-considerations.rst @@ -55,18 +55,18 @@ complete contract): :: - pragma solidity ^0.4.0; - - // THIS CONTRACT CONTAINS A BUG - DO NOT USE - contract Fund { - /// Mapping of ether shares of the contract. - mapping(address => uint) shares; - /// Withdraw your share. - function withdraw() { - if (msg.sender.send(shares[msg.sender])) - shares[msg.sender] = 0; - } - } + pragma solidity ^0.4.0; + + // THIS CONTRACT CONTAINS A BUG - DO NOT USE + contract Fund { + /// Mapping of ether shares of the contract. + mapping(address => uint) shares; + /// Withdraw your share. + function withdraw() { + if (msg.sender.send(shares[msg.sender])) + shares[msg.sender] = 0; + } + } The problem is not too serious here because of the limited gas as part of ``send``, but it still exposes a weakness: Ether transfer always @@ -79,18 +79,18 @@ outlined further below: :: - pragma solidity ^0.4.11; + pragma solidity ^0.4.11; - contract Fund { - /// Mapping of ether shares of the contract. - mapping(address => uint) shares; - /// Withdraw your share. - function withdraw() { - var share = shares[msg.sender]; - shares[msg.sender] = 0; - msg.sender.transfer(share); - } - } + contract Fund { + /// Mapping of ether shares of the contract. + mapping(address => uint) shares; + /// Withdraw your share. + function withdraw() { + var share = shares[msg.sender]; + shares[msg.sender] = 0; + msg.sender.transfer(share); + } + } Note that re-entrancy is not only an effect of Ether transfer but of any function call on another contract. Furthermore, you also have to take @@ -179,7 +179,9 @@ Never use tx.origin for authorization. Let's say you have a wallet contract like } } -Now someone tricks you into sending ether to the address of this attack wallet:: +Now someone tricks you into sending ether to the address of this attack wallet: + +:: pragma solidity ^0.4.11; |