I'm writing a contract for an ERC20 token, based on Zepellin contracts. I noticed that their code doesn't handle the short address attack. Does it mean I shouldn't care about it?
There was a discussion about that.
Main reason is that it is a vulnerability of other contracts, and not token itself. It's their work to check all arguments. So yes, you should not care about it as token developer, but should care as contract developer).
-
If say an exchange interacts directly with the token contract's code, shall I assume that they do care about it? – ulu Dec 20 '17 at 20:12
-
1From my point of view there is no reason to take others' rensponsibilities. You can't protect everyone from shooting in a knee. – Andrey Putilin Dec 20 '17 at 20:35
-
1@ulu : I think this kind of mistake fell in the honeypot level : I mean it’s unlikely you’ll find an exchange with volume above 1000$ per day that would be still vulnerable (though it would be your self rewarding exercise to try a tiny withdraw check against each entry in that list). – user2284570 Jun 6 '18 at 20:53
