0

I am trying to understand a basic threat model for Ethereum Smart Contracts, to perform some research on how existing attacks techniques may be applied here as well. Is there a risk of a contract with a public function, which when malicious data is passed, may allow the program control flow jump to private functions (violating the private indentifier), or inject bytecode which would ever be executed?

0

I don't believe so unless there is some sort of compiler exploit after the contract is deployed. Interestingly enough EtherDelta experienced a sort of XSS attack as someone had put javascript code into their token that was uploaded to EtherDelta, which would allow that javascript code to execute.

https://davidgerard.co.uk/blockchain/2017/09/28/etherdelta-hack-malicious-javascript-in-a-contract-name-stealing-the-users-key/

  • Interesting attack path. I was wondering if there was a way that delegate calls going out to libraries may allow malicious library code to call private functions somehow, since the context of the code changes in that case. – Kevin Larson Mar 11 '18 at 23:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.