0

I'm reading this issue, and quote:

I was able to make myself the owner of that contract because its uninitialized.

So I opened this link to view the contract, but I didn't find the part that is "uninitialized".

What does he mean here?

Improve this question
0

1 Answer 1

Reset to default
1

The WalletLibrary contract is used to provide the logic for all Wallet instances. Each instance had to initialized by calling initWallet (line 223) with the owners and other configuration params. This method sets the owners by calling initMultiowned. When you now perform an action against an instance the onwership is checked via the onlymanyowners (line 95) modifier. To prevent multiple initializations the contracts has a only_unitialized (line 219) modifier, which checks if any owners have already been registered.

So this is all expected, the point is that you can do the same with the WalletLibrary and take the ownership of it by calling initWallet. Once that has been done you can perform any interaction on it, even destroying it via the kill method (line 229). Problem is when the WalletLibrary code is removed from the blockchain when it is killed, that also all Wallet instances lose their functionality.

Some more info: https://www.parity.io/blog/security-alert-2/

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.