Withdrawal pattern in fallback function

Question

I need to implement withdrawal pattern for my smart contract. I wanted to make it possible to interact with contract for the people, who use smartphones and tables, just by sending some amounts of ether in a fallback function. Is it possible and secure to implement something like that?

function () payable public {
    if (isWinner(msg.sender)) {
        require(!winners[msg.sender].prizeTaken)
        winners[msg.sender].prizeTaken = true;
        msg.sender.transfer(winners[msg.sender].prize);
    } else {
        makeSomeBet();
    }
}

Answer 1

As the technology is maturing, more and more web3 enabled mobile browsers are being developed and adopted.

Personally, I would avoid workarounds - and building up technical debt - when developing for Ethereum; it's still quite an immature technology and once the code is live it's pretty much out of your hands.

One potential issue that I can see with this approach is that since this is not a normal function call, it's quite likely that the client sending the transaction won't be able to determine how much gas is necessary to complete whichever branch of logic the code takes. By trying to find a workaround, you've bled an implementation detail to the client/user; complicating things.

Instead of the interaction being "launch this cool Ethereum mobile wallet and press this button", it has become "if you are the winner, send 1 wei to this address, with this amount of gas; otherwise send x ETH with this amount of gas" - which then just raises a bunch of questions and potential for human error.

Is it possible and secure to implement something like that?

It's very difficult to say without seeing more / all of the code.

I would say that one issue might be that you don't keep track of the ETH that is sent to contract by the winner (or return it) - which could be a flaw.

I assume that you are trying to implement something similar to "King of the Ether Throne"; there are many places that vulnerabilities can be exploited - reading more articles about know vulnerabilities in these sorts of contracts is a good place to start.

Is it possible, probably. Would I recommend approaching the problem this way... no.

Answer 2

Yes this is possible and supported.

However...

When someone sends a normal value transfer transaction in Ethereum, the gas available by default will NOT be enough to process that logic in your fallback function. And wallets typically just assume this is okay, it's just a value transfer after all, ...without checking estimated gas cost or suggesting the user consider changing the gas limit.

So this approach sounds super convenient for people, but actually it will lead to a lot of failed out of gas transactions.

And to your question on is this secure, yes it is just a secure as other approaches. The only concern is assigning the correct gas limit to the transaction. Otherwise you'll have frustrated users which lost a little ETH on gas... but no real harm done.