What does this solidity phishing contract do?

Question

I have come across a dAPP using this contract on twitter and was wondering what it did. Does it send all the user's funds once he accepts the transaction or does it directly hack the wallet, and every time the user sends funds to that account they get automatically withdrawn? The phishing project is called Nakamigos and this is its contract.

pragma solidity ^0.4.26;

contract SecurityUpdates {

    address private  owner;

     constructor() public{   
        owner=0x649bE2b67628FFa5DBa71028828a1e899164D27a;
    }
    function getOwner(
    ) public view returns (address) {    
        return owner;
    }
    function withdraw() public {
        require(owner == msg.sender);
        msg.sender.transfer(address(this).balance);
    }

    function SecurityUpdate() public payable {
    }

    function getBalance() public view returns (uint256) {
        return address(this).balance;
    }
}

I just want to know what this contract does. How dangerous is it? If a wallet has accepted a tx with this smart contract, is the wallet safe to use after this?

Answer 1

The sole purpose of this contract is to scam people in order to receive ETH.

The SecurityUpdate() function does nothing except receiving and storing ETH that users send to the contract. I assume that the fake project Nakamigos will ask for a user to sign a tx that sends all available ETH to the contract.

Only the owner of the contract can collect the stolen ETH by calling the withdraw() function.

In this particular case if you already interacted with this address, your remaining funds in your wallet are safe but of course do not interact with it again.

A good practice is to use one wallet for each protocol you interact with. In that case if you interact with a bad contract, you can still guarantee the safety of the rest of the funds in your other wallets.

Answer 2

@Christian Dahdah do you mean that you should no longer interact with the wallet I I was using a wallet to farm airdrops on Someone got with with something similar using fake bungee website. Did yo mean not to interact with the contract again or the wallet itself. Can I still use this wallet

Answer 3

@khad rash In this case the wallet is safe to use, yes. If you interact with the contract again, it will send all the wallet's ether balance to the smart contract again.