All contracts have addresses. Is it, in theory, possible to find the private key of this address and then get access to this contract? Questions if this is possible:
- If one gets access to the contract, can they send transactions from this contract? Or even drain the balance of the contract?
- What if someone gets access to this contract address before creating the contract itself? This would mean TX already exist in this contract before it is created. Does that have any consequence?
This sounds like a very interesting attack vector to me. Imagine someone creating a contract which attracts a lot of ether. The code in the contract states that the owner cannot drain ether. However, the owner has the private key of this contract and suddenly sends a transaction draining all the ether.
It is claimed that 'contracts have no private key'. But I can create a private key which gives me the same address as the contract. What if I call
extcodesize in another contract on
msg.sender? What if I send a transaction from the contract and one from the EOA? The creation of a contract should create code in an address and hence
extcodesize changes from 0 to nonzero when a contract is created, hence both calls from EOA and contract come from the same source and
extcodesize returns nonzero. Hence contracts have private keys.