aboutsummaryrefslogtreecommitdiffstats
path: root/docs/security-considerations.rst
diff options
context:
space:
mode:
authorchriseth <chris@ethereum.org>2017-11-30 23:08:09 +0800
committerGitHub <noreply@github.com>2017-11-30 23:08:09 +0800
commitc4cbbb054b5ed3b8ceaa21ee5b47b0704762ff40 (patch)
tree27c068f6cd96513a9023e586c209eb9f01309171 /docs/security-considerations.rst
parent9cf6e910bd2b90d0c9415d9c257f85fe0c518de8 (diff)
parentd0af0c14841648365ad05ecc626e672a16df5b5c (diff)
downloaddexon-solidity-c4cbbb054b5ed3b8ceaa21ee5b47b0704762ff40.tar
dexon-solidity-c4cbbb054b5ed3b8ceaa21ee5b47b0704762ff40.tar.gz
dexon-solidity-c4cbbb054b5ed3b8ceaa21ee5b47b0704762ff40.tar.bz2
dexon-solidity-c4cbbb054b5ed3b8ceaa21ee5b47b0704762ff40.tar.lz
dexon-solidity-c4cbbb054b5ed3b8ceaa21ee5b47b0704762ff40.tar.xz
dexon-solidity-c4cbbb054b5ed3b8ceaa21ee5b47b0704762ff40.tar.zst
dexon-solidity-c4cbbb054b5ed3b8ceaa21ee5b47b0704762ff40.zip
Merge pull request #3261 from ethereum/develop
Merge develop into release for 0.4.19
Diffstat (limited to 'docs/security-considerations.rst')
-rw-r--r--docs/security-considerations.rst50
1 files changed, 26 insertions, 24 deletions
diff --git a/docs/security-considerations.rst b/docs/security-considerations.rst
index 6586cb5f..337a3d3f 100644
--- a/docs/security-considerations.rst
+++ b/docs/security-considerations.rst
@@ -55,18 +55,18 @@ complete contract):
::
- pragma solidity ^0.4.0;
-
- // THIS CONTRACT CONTAINS A BUG - DO NOT USE
- contract Fund {
- /// Mapping of ether shares of the contract.
- mapping(address => uint) shares;
- /// Withdraw your share.
- function withdraw() {
- if (msg.sender.send(shares[msg.sender]))
- shares[msg.sender] = 0;
- }
- }
+ pragma solidity ^0.4.0;
+
+ // THIS CONTRACT CONTAINS A BUG - DO NOT USE
+ contract Fund {
+ /// Mapping of ether shares of the contract.
+ mapping(address => uint) shares;
+ /// Withdraw your share.
+ function withdraw() {
+ if (msg.sender.send(shares[msg.sender]))
+ shares[msg.sender] = 0;
+ }
+ }
The problem is not too serious here because of the limited gas as part
of ``send``, but it still exposes a weakness: Ether transfer always
@@ -79,18 +79,18 @@ outlined further below:
::
- pragma solidity ^0.4.11;
+ pragma solidity ^0.4.11;
- contract Fund {
- /// Mapping of ether shares of the contract.
- mapping(address => uint) shares;
- /// Withdraw your share.
- function withdraw() {
- var share = shares[msg.sender];
- shares[msg.sender] = 0;
- msg.sender.transfer(share);
- }
- }
+ contract Fund {
+ /// Mapping of ether shares of the contract.
+ mapping(address => uint) shares;
+ /// Withdraw your share.
+ function withdraw() {
+ var share = shares[msg.sender];
+ shares[msg.sender] = 0;
+ msg.sender.transfer(share);
+ }
+ }
Note that re-entrancy is not only an effect of Ether transfer but of any
function call on another contract. Furthermore, you also have to take
@@ -179,7 +179,9 @@ Never use tx.origin for authorization. Let's say you have a wallet contract like
}
}
-Now someone tricks you into sending ether to the address of this attack wallet::
+Now someone tricks you into sending ether to the address of this attack wallet:
+
+::
pragma solidity ^0.4.11;