How does the token get onto this contract address?

Question

So I was looking at the source code for the Fucktoken ICO. This is the smart contract account code, but I was wondering; how does the owner get the Fucktokens on the account/contract, and how can he control the actual contract once it's running, this one specifically.

pragma solidity ^0.4.11;

contract token { function transfer(address receiver, uint amount){ receiver; amount; } }

contract Crowdsale {
address public beneficiary;
uint public fundingGoal; uint public amountRaised; uint public deadline; uint public price;
token public tokenReward;
mapping(address => uint256) public balanceOf;
bool fundingGoalReached = false;
event GoalReached(address beneficiary, uint amountRaised);
event FundTransfer(address backer, uint amount, bool isContribution);
bool crowdsaleClosed = false;

/* Data structure to hold information about campaign contributors */

/*  At initialization, setup the owner */
function Crowdsale(
    address ifSuccessfulSendTo,
    uint fundingGoalInEthers,
    uint durationInMinutes,
    uint weiCostOfEachToken,
    token addressOfTokenUsedAsReward
) {
    beneficiary = ifSuccessfulSendTo;
    fundingGoal = fundingGoalInEthers * 1 ether;
    deadline = now + durationInMinutes * 1 minutes;
    price = weiCostOfEachToken * 1 wei;
    tokenReward = token(addressOfTokenUsedAsReward);
}

/* The function without name is the default function that is called whenever anyone sends funds to a contract */
function () payable {
    if (crowdsaleClosed) throw;
    uint amount = msg.value;
    balanceOf[msg.sender] = amount;
    amountRaised += amount;
    tokenReward.transfer(msg.sender, amount / price);
    FundTransfer(msg.sender, amount, true);
}

modifier afterDeadline() { if (now >= deadline) _; }

/* checks if the goal or time limit has been reached and ends the campaign */
function checkGoalReached() afterDeadline {
    if (amountRaised >= fundingGoal){
        fundingGoalReached = true;
        GoalReached(beneficiary, amountRaised);
    }
    crowdsaleClosed = true;
}


function safeWithdrawal() afterDeadline {
    if (!fundingGoalReached) {
        uint amount = balanceOf[msg.sender];
        balanceOf[msg.sender] = 0;
        if (amount > 0) {
            if (msg.sender.send(amount)) {
                FundTransfer(msg.sender, amount, false);
            } else {
                balanceOf[msg.sender] = amount;
            }
        }
    }

    if (fundingGoalReached && beneficiary == msg.sender) {
        if (beneficiary.send(amountRaised)) {
            FundTransfer(beneficiary, amountRaised, false);
        } else {
            //If we fail to send the funds to beneficiary, unlock funders balance
            fundingGoalReached = false;
        }
    }
}

}

Answer 1

The question itself carries an invalid assumption.

The account that "holds" the token doesn't really hold anything. What happens instead is that the token smart contract records the fact that a particular account has X tokens.

If you were to study the "holding" account there would be no indication that that account "holds" anything. The token smart contract records that fact. The ownership is stored in the history of transactions on the "holding" account, but the account itself doesn't hold anything.

This is why you have to "watch" token contracts in your Mist or Parity wallet. If you didn't do that, the wallets would have no way to know which tokens you hold.

Answer 2

Referring to your questions:

how does the owner get the Fucktokens on the account/contract

Owner pass to the crowdsale contract reference to token contract. It's assumed to Owner mint sufficient amount of tokens to the crowdsale contract account prior to starting the sale:

tokenReward = token(addressOfTokenUsedAsReward);

how can he control the actual contract once it's running, this one specifically

It's considered a best practice to have a trustless contract in which all of the rules are encoded at the creation phase and owner doesn't leave any backdoors (methods that only he is authorised to execute) that can affect original execution rules.

Answer 3

The function Crowdsale has the same name as the contract, so it is the constructor that is called when contract is deployed. You can see that the address passed in argument ifSuccessfulSendTo is saved as beneficiary field in the contract. The person deploying the contract will presumably send an address controlled by themselves but he/she might want to let someone else be the beneficiary, too. Then, note that in function safeWithdrawal that is called after the deadline is reached, if the funding goal is reached and the function is called by beneficiary account (i.e. beneficiary == msg.sender), then the amount raised is sent to the beneficiary account. This is how owner controls the contract once it is running.

Now, how does ether sent to contract get added to it? Look at the anonymous function under the comment line /* The function without name is .... This function is called whenever ether is sent to the contract address and there is no function to be called. This function records the amount msg.value as sent by msg.sender.