Looking through the docs I found that a malicious caller can take the stack depth to ~1000 and then make a call which would fail due to stack depth. Based on that let's assume that stack indeed persists through calls.
So, is it possible that an entity can make a legit contract call their malicious contract and then use the SWAP16
opcode to manipulate the 15th
stack value even though it was not meant to be accessible?
Like consider this
function sendEtherAndCall(address maliciousRecipient) external preventRentrant{
uint someEther = balances[maliciousRecipient];
balances[maliciousRecipient] = 0;
bool success = maliciousRecipient.send(someEther);
maliciousContract.call("Some function that uses SWAP 16");
if(!success) balances[maliciousRecipient] = someValue; // Send failed
}
Is it possible to do this? Can the malicious contract use something like
PUSH false
SWAP16
Which makes the bool success
as false
even though it was successful? I just assumed that bottom 15th value would be the bool success
. But is it possible?