An airdrop ask to send it 0ETH with 150000 GAS and some datas in DATA field. Is it safe? What could be the aim of this transaction? Thanks.
2 Answers
Sending 0 ETH but with data just serves the purpose of creating/storing information (that data) on the blockchain, as well as related information (e.g. sender, receiver).
The gas is just the cost of sending the transaction.
Just note that the data you send is publicly available to everyone, so it's "safe" as long as you understand that and don't send any confidential information.
Generally, no! It can be dangerous.
If you are asked to send such a transaction, you should understand what is the source code of the address you are sending to, and what function you might be invoking with the data you are sending.
Do not send arbitrary data to some arbitrary address because that is like running an arbitrary program, clicking on an arbitrary link, opening an arbitrary email attachment, and it could all be malicious.
For example, you might have a lot of some particular ERC-20 token and if you blindly send data to some address, you might be approving an attacker to be able to steal all your tokens. (The address you are sending to would be the token contract, and the data would be invoking the approve function with the attacker's address.)
(It's possible that the data is static, but usually the data is an ABI encoding of what you will end up executing.)
-
2This. The data value indicates which function of that smart contract are you going to execute and with which parameters. You should trust the smart contract or be able to read the code. Nov 2, 2017 at 11:08
-
@eth does the data being sent have to have the sender's instructions / authorization for the approval you mentioned? Or is there a scenario where any random data (e.g. "hello world") actually gives the receiving contract that authority? If the latter, then doesn't that basically imply the vulnerability you mention to any contract / any function?– carlolmNov 3, 2017 at 5:01
-
@carlolm We agree and late reply as it was hard to understand your comment. The token case is an easy example and the main advice is to not sign a transaction or send data, without understanding what you are signing... For example, even if you have a virus scanner, it would probably be unwise to knowingly run an arbitrary program because the scanner might miss something even though it might be safe 99% of the time.– eth ♦Sep 17, 2018 at 7:18
-
If I send short text messages in the DATA field of a transaction, something like "Hello World," is that also dangerous? Is there anything I can do to ensure that a text string won't run any additional EVM code?– tjr226May 5, 2021 at 19:24
-
1@tjr226 That may be worth another question, and it would probably be a good idea to explain more what you want to do instead of keeping it very general. It sounds like you want to do something with an unknown contract rather than an EOA and others may have better solution for you. With unknown contracts you also have to be careful because contracts deployed with CREATE2 can get new code. A safe answer to your general question may need more thought.– eth ♦May 7, 2021 at 0:56
msg.sender(ortx.origin).]