An airdrop ask to send it 0ETH with 150000 GAS and some datas in DATA field. Is it safe? What could be the aim of this transaction? Thanks.

  • There's a lot of value in the first part of this question. I suggest asking the second part of the question, some specific airdrop's transaction, separately. [My old comment: What data is being requested? If they just want to know address, then no data is needed as they can just use msg.sender (or tx.origin).] – eth Nov 2 '17 at 10:39
  • Good point - what @eth said. Retracted my comment for safety. +1 his/her answer. – Richard Horrocks Nov 2 '17 at 11:14
  • I stand corrected, good point @Eth. If you uncheck my response, I’ll also retract. Thanks – carlolm Nov 2 '17 at 11:28
up vote 0 down vote accepted

Sending 0 ETH but with data just serves the purpose of creating/storing information (that data) on the blockchain, as well as related information (e.g. sender, receiver).

The gas is just the cost of sending the transaction.

Just note that the data you send is publicly available to everyone, so it's "safe" as long as you understand that and don't send any confidential information.

Generally, no! It can be dangerous.

If you are asked to send such a transaction, you should understand what is the source code of the address you are sending to, and what function you might be invoking with the data you are sending.

Do not send arbitrary data to some arbitrary address because that is like running an arbitrary program, clicking on an arbitrary link, opening an arbitrary email attachment, and it could all be malicious.

For example, you might have a lot of some particular ERC-20 token and if you blindly send data to some address, you might be approving an attacker to be able to steal all your tokens. (The address you are sending to would be the token contract, and the data would be invoking the approve function with the attacker's address.)

(It's possible that the data is static, but usually the data is an ABI encoding of what you will end up executing.)

  • 1
    This. The data value indicates which function of that smart contract are you going to execute and with which parameters. You should trust the smart contract or be able to read the code. – AdrianClv Nov 2 '17 at 11:08
  • @eth does the data being sent have to have the sender's instructions / authorization for the approval you mentioned? Or is there a scenario where any random data (e.g. "hello world") actually gives the receiving contract that authority? If the latter, then doesn't that basically imply the vulnerability you mention to any contract / any function? – carlolm Nov 3 '17 at 5:01
  • @carlolm We agree and late reply as it was hard to understand your comment. The token case is an easy example and the main advice is to not sign a transaction or send data, without understanding what you are signing... For example, even if you have a virus scanner, it would probably be unwise to knowingly run an arbitrary program because the scanner might miss something even though it might be safe 99% of the time. – eth Sep 17 at 7:18

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.