0

I studied The DAO attack. Ethereum's reentrancy attack is still work. but ethereum network also still work( Sure, compiler says "warning" )

How do you believe your contract will be safe? How ethereum patch this bug?

and How can send ether to anyone without calling fallback function? this is cause of dao attack

Have ethereum got good idea?

i want you to let me know please.

  • I want to know method of ethereum. Don't say secure coding please. – cidiot Sep 6 '17 at 15:47
  • The DAO hack was not an Ethereum bug. It's like blaming computer crashes on a C compiler. – lungj Sep 6 '17 at 16:42
  • @lungj computer crashes??? I don't understand.. If you have ref site for me? – cidiot Sep 7 '17 at 3:32
2

When sending ether

Using address.transfer or address.send is the simple and reentrant-safe way to send ether.

TheDAO used call.value which is more powerful but also has risks for reentrancy: What does `call.value` mean and how did it allow the attack to The DAO?

Generally

Reentrancy is an issue when code can call back into your contract and change state, such as withdrawing ether.

Keep an eye on Solidity leveraging the new opcode STATIC_CALL (EIP 214) for a general solution:

To increase smart contract security, this proposal adds a new opcode that can be used to call another contract (or itself) while disallowing any modifications to the state during the call (and its subcalls, if present).

1

If you use the "send" or "transfer" functions, then you are safe against the DAO attack, as those functions do not delegate enough gas for the fallback function to make a function call itself.

There is no protection in Ethereum against all reentrancy, as it may be a feature and not a bug ; but if you use send your are probably safe.

  • Thanks, I overlook gas system. It helped me, but I can't vote because this site system. – cidiot Sep 7 '17 at 3:27
  • Ensure you check the return value if using send. – Tom Hale Oct 1 '17 at 8:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.