Say I have a "master" contract that can create other "servant" contracts. The master contract routes users into different servant contracts and each servant contract should only be able to be accessed by one user (and as a result has a modifier that throws unless the msg.sender is the master contract).
My worry is that someone could create a servant contract that uses DELEGATECALL to call into a different servant contract than the one they are supposed to access.
So my question is two-fold - would DELEGATECALL allow this type of attack? And if so, is it possible to defend against this type of attack?
Thanks!
call(data)
where data is the new servant contract? – Roland Kofler Jan 22 '17 at 11:37DELEGATECALL
just pull code out of the contract, not its storage. – Xavier Leprêtre B9lab Jan 22 '17 at 16:50