1

I know that handing out your private key is like handing over your wallet and say "help yourself", but...

if I had register my public ETH address on some unknown smart contract (like sending a "transaction data" with MetaMask using 0 ETH), is it possible for the smart contract to withdraw/transfer ETH or any tokens from my wallet like a bank's debit order?

Improve this question

1 Answer 1

Reset to default
0

If you don't send any ether to a contract, it can't take any ether directly from you.

Tokens are another story. Those are just balances maintained in a smart contract. Most token transfers involve 0 ETH. Certainly sending a transaction to a token contract could result in those tokens being transferred, but even sending a transaction to a different contract could result in moved tokens. (A common case of this is ERC20 tokens' approve/transferFrom flow.)

Improve this answer
9
  • No tokens or ETH was transferred for days. Could the contract at some later time transfer tokens without my knowledge because I had "registered"? Or would that require another transaction that needs to be initiated from my side? The reason, I am asking is to understand what scammers are capable of.
    – Jasper Citi
    Mar 17, 2018 at 10:47
  • 1
    Token contracts can be written to do arbitrary things, so anything is possible. E.g. a token could allow transfers at any time from any account that had called "allow()" in some other contract. (This would be quite unusual, but you're asking about what's possible. When it comes to tokens, pretty much anything is possible.)
    – user19510
    Mar 17, 2018 at 10:52
  • What would call an "allow()"? As far as I understand MetaMask only has a "transaction data" field. Can MetaMask "allow()"?
    – Jasper Citi
    Mar 17, 2018 at 10:56
  • Yes, the data field is what specifies, what function is being called in a contract and with what parameters.
    – user19510
    Mar 17, 2018 at 10:57
  • So, a scammer could potentially say "Register for my airdrop by sending a transaction with 0 ETH and data 'xyz' to my address" which could potentially call "allow()" so that the scammer can help himself later with the tokens in owner's account?
    – Jasper Citi
    Mar 17, 2018 at 11:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.