2

Assume a malicious code exists in a contract (either written intentionally or not). Is there any mechanism to prevent such codes from being executed? Is it even possible to do the monitoring?

6

From the context, I assume you're concerned about malicious code affecting the machine it runs on. This isn't an issue*, because EVM code runs in a very restrictive interpreter sandbox. Code has to be written using EVM instructions, which are limited to affecting the state of the virtual machine itself, and reading and writing blockchain state; by design, there's no way to access or influence the state of the machine it runs on. This is necessary both for security, and to ensure consensus.

** Barring vulnerabilities in the EVM itself, which are unlikely with common implementations, but perhaps more plausible with a JIT-based implementation.

3

You can upgrade a contract based on the DELEGATECALL opcode and the SUICIDE opcode.
Obviously only a throughout pentesting can asses malicious code.

2
  • 1
    Is it even possible to implement some anti-virus or anti-malware to monitor the contracts before hand? – Kobayashi Jun 3 '16 at 11:10
  • 1
    Yes you can run some static and dynamic analysis and find some typical holes in the contracts. Actually a good idea that someone runs this service and generates automatic reports... – Roland Kofler Jun 3 '16 at 11:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.