Did I effectively lock me out of my own smart contract?

Question

I am afraid that I have locked myself out of my own contract and that my funds are frozen inside. It would be great if someone could confirm this.

I've created the following smart contract using the ethereum wallet: 0xdCC90B1Eace5c2190F1eB2EFa36fa24f69dAD091

The account that I used to create the smart contract was as follows: 0x128e9DE813f598C24403e5F67946D11AAFcCff7e

After a series of unsuccessful attempts to transfer my funds I used the parity wallet to make changes to the contract functions themselves. I believed that the error could be fixed by making changes to the smart contract. While doing this I apparently removed myself as the only contract owner. See the following Tx Hash: 0x6affa9e915dd758efca2458b523743ff32eb3b997a351ff250c5336ad6100382

After this, nothing could be executed on the contract any more. Does this mean that I effectively removed myself from the smart contract and that all my funds are locked in there forever? And is there no other chance to access the funds and this smart contract now (and in the future)?

If so, I really think there should be some sort of standard protection, so that the contract owner cannot remove himself from the contract without notification etc...

Answer 1

Yes, I think you are locked out.

Don't be fooled by m_numOners being 1 - the code doesn't seem to account for the case of all owners being removed, so it puts a floor of 1 on m_numOwners here, but doesn't actually prevent the removal of the last owner:

while (m_numOwners > 1 && m_owners[m_numOwners] == 0) m_numOwners--;

I think if you had set _required (which gets put into m_required) to 1 instead of 0 when creating the contract it would not have let you do this. I don't think the contract properly deals with the edge case of m_required being 0.

You can confirm by calling the isOwner method on the contract with your address. I do it like this:

> web3.eth.call({"to":"0xdCC90B1Eace5c2190F1eB2EFa36fa24f69dAD091", "data":"0x2f54bf6e000000000000000000000000128e9de813f598c24403e5f67946d11aafccff7e"}).then(console.log);
> 0x0000000000000000000000000000000000000000000000000000000000000000

The zero response means false. You can also confirm on the MyEtherWallet Contract tab - paste in the contract address and the ABI. You'll need to edit the ABI for isOwner to set "constant":true to call it from there. It also returns false: i.e. this address is not an owner.

Answer 2

You cannot change the code of a smart contract after it is deployed.

If you go to "Read Smart Contract" on Etherscan, it says that the contract still has 1 owner (m_numOwners = 1): https://etherscan.io/address/0xdcc90b1eace5c2190f1eb2efa36fa24f69dad091#readContract

Are you sure you didn't add another address as owner? Maybe you could use that address to access the contract?

In the future, wallet applications such as Parity could give warnings like that, but that is not easy to program at all. The wallet software would have to do a deep analysis of the smart contract being used, and simulate its execution is many different situations. It will be possible to give such warnings in the future.