In this example from the Solidity documentation, inside the bid function, there is this comment:

Sending back the money by simply using highestBidder.send(highestBid) is a security risk because it could execute an untrusted contract. It is always safer to let the recipient withdraw their money themselves.

Why would this be a security risk? Can someone provide an example? Thanks in advance.

3 Answers 3


If highestBidder is a contract address. It can prevent you from sending Ether to it or Reentrancy Attack



It would be a risk due to several possible reasons. For example if your contract functioning depends on the ether being received by A, a malicious user may enter the address of some smart contract B as A. However, B would simply not accept any payments in eth, which would probably cause your contract to not function as expected. Another possible attack could be a re-entrancy attack.


When sending ether to an external contract your contract may fall victim to a denial of service or reentrancy attack.

pull payment

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.