2
function redeem(uint256 _token) public {
    // transfering the token from tokenholder to owner
    token tokenBalance = token(tokenAddress);
    tokenBalance.transferToOwner(owner, _token);

    // the tokenholder gets the ethereum
    uint256 weiVal = (_mtcTokens * redeemRate);
    msg.sender.transfer(weiVal);
}

The first part of the function is transfering the token from the holder to owner by calling an external function in another contract. The second part is transfering the ethereum for each token transfered.

Does the first part will work in a synced manner (i.e. the code will run line by line) OR the execution of second part can happen even if the execution of first part is not completed?

Are there any security flaws (like re-entry attack etc)?

1 Answer 1

2

It all happens in a single thread in the EVM.

There is a reentrancy attack, which basically means a "recursive" call, when the same function is called while the previous execution of this function is not finished yet. You can read more here https://consensys.github.io/smart-contract-best-practices/known_attacks/#reentrancy

6
  • So there is no reentry attack in the code above because it's happening in single thread, right? Any example code which are prone to re-entry attack? Thanks. Commented Feb 20, 2018 at 12:41
  • Yes your code looks fine because transfer is called last. You can read about reentrancy here consensys.github.io/smart-contract-best-practices/known_attacks/… Commented Feb 20, 2018 at 12:57
  • How to figure out if its on single thread or not? Commented Feb 21, 2018 at 10:50
  • One way is to look into evm sources github.com/ethereum/go-ethereum/blob/master/core/vm/…. All opcodes including CALL are executed synchronously in a single thread res, err := operation.execute(&pc, in.evm, contract, mem, stack) Commented Feb 21, 2018 at 11:01
  • Is it possible to check the threads on remix code editor? Thanks. Commented Feb 21, 2018 at 18:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.