0

I've deployed my contract using the unaltered "Full Code" as specified here: https://www.ethereum.org/token#full-coin-code.

Once the contract has been formed, I seem to be able to administer it without issue using the - Burn, Mint Token, Transfer, Freeze Account & Transfer Ownership functions.

I'm now testing the Burn From & Transfer From functions, however when I try to execute a contract to say burn half of the tokens from the target accounts balance, executed from the contract owner account I get the message "It seems this transaction will fail. If you submit it, it may consume all the gas you provide." When I execute the contract I get a message "Intrinsic Gas Too Low".

Is there a bug in the sample code or (more likely) what am I doing wrong? Is there some security issue (do I need to turn on the ability to transfer from users accounts somewhere else)?

Thanks

  • 2
    I read the functions you're refering to, and found this: If you want to use burnFrom and/or transferFrom, the target address first needs to give you an 'allowance' by calling approve. You can't just burn or transfer someone else's tokens without their authorization, that would be a huge security flaw. – Jesse Busman Dec 27 '17 at 9:23
  • Thanks Jesse. OK. That makes sense. Is there anyway of removing this authorization so that the contract admin has this ability by default? In certain use cases such as mine this is desired. – Mr T Dec 27 '17 at 11:41
  • It's pretty trivial to make that change. – Jesse Busman Dec 27 '17 at 13:38
  • OK. I'm getting to grips with the language. Looking at the burnFrom function, I'd presumably omit the line require(_value <= allowance[_from][msg.sender]); // Check allowance with the transferFrom function I'm unsure whether to remove just the first or the first & second lines of the function function transferFrom(address _from, address _to, uint256 _value) public returns (bool success) { require(_value <= allowance[_from][msg.sender]); // Check allowance allowance[_from][msg.sender] -= _value; _transfer(_from, _to, _value); return true; }? – Mr T Dec 27 '17 at 14:21
  • The second part of that code isn't clear... Unsure whether to remove: require(_value <= allowance[_from][msg.sender]); // Check allowance or require(_value <= allowance[_from][msg.sender]); // Check allowance allowance[_from][msg.sender] -= _value;? Thanks @JesseBusman – Mr T Dec 27 '17 at 14:22
1

This is not a solution, rather a bug. You should not remove the line require(_value <= allowance[_from][msg.sender]); without knowing its impact. If you remove this line, anyone can move tokens other address, which is huge vulnerability. I can spend tokens from your account without your concent. The allowance is there to verify that if you have allowed me 100 tokens then I can only spend 100 tokens from your account.

The transferFrom and approve work together. If you want someone to spend some tokens from your account, you approve them that amount. This value gets stored in allowance. Now when spender tries to use transferFrom to spend funds from your account, smart contract verifies that whether you have allowed the spender to spend given tokens from your account.

0

I solved this as follows:

With reference to the code in the link in the question, I altered the function transferFrom on line 99 tothe following:

function transferFrom(address _from, address _to, uint256 _value) public returns (bool success) {
    allowance[_from][msg.sender] -= _value;
    _transfer(_from, _to, _value);
    return true;
}

This removed the top line from the function (require(_value <= allowance[_from][msg.sender]); // Check allowance). I can now freely transfer funds from another users account.

Similarly, I've altered the burnFrom function (line 162) to as follows:

function burnFrom(address _from, uint256 _value) public returns (bool success) {
    require(balanceOf[_from] >= _value);                // Check if the targeted balance is enough
    balanceOf[_from] -= _value;                         // Subtract from the targeted balance
    allowance[_from][msg.sender] -= _value;             // Subtract from the sender's allowance
    totalSupply -= _value;                              // Update totalSupply
    Burn(_from, _value);
    return true;
}

Removing the second line of code in the function (require(_value <= allowance[_from][msg.sender]); // Check allowance).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.