2

When I'm going through best practices of smart contract I came across https://consensys.github.io/smart-contract-best-practices/general_philosophy/ this site. They have mentioned

    Understand that your public functions are public, and may be called maliciously. 
Your private data is also viewable by anyone.

My doubt is without knowing abi or the contract address how come one know my function name?

4

It is pretty easy to detect when a contract is created in the blockchain. Anyone can create a listener that will detect that events. And the address of the created contract is public.

There is a listing of known public functions like 4byte directory. So it is pretty easy for someone to call functions on a contract.

If you remember the parity multisig wallet attack, it was done by someone that was randomly sending to contracts to execute some functions, for example kill(), etc. If you do not protect your contract properly it might cause serious problems.

Obviously a determined hacker can reverse engineer your bytecode and create an specific attack.

2

I went through the site you posted, it is mainly providing advice on best practices on writing your smart contract, e.g. when you write your dapp and release it for public use. Then all those external/public functions can be accessed by other people, including malicious ones.

If you really want to deploy your contract to the network and keep it super private temporarily, it is generally true that without correctly reverse-engineering your bytecode, a malicious party would not know your function names/abi. @Ismael illustrated a good example on how a malicious node can detect new contracts and trying to mess up with them, even though the malicious node may not know the contract address correspond to yours specifically. He also raised the example of randomly calling kill() to kill contracts -- it's a good practice to implement ownership for the contract so that only the owner of the contract can kill() the contract (you may want to check on Ownable at https://github.com/OpenZeppelin/openzeppelin-solidity/blob/master/contracts/ownership/Ownable.sol).

Remember, it's all about best practices. You can make your function name look like TrrraAAnnSferrrooowneeershiIIPPp() which works fine. But you generally want to name it like transferOwnership() as a "best practice".

Hope this helps.

2

You are right, if people do not know the ABI they will not know how to interface with your contract (maybe through the opcodes but let's keep it simple). However, they will get this from you, because you want people to interact with your contract. If you have a token and you want it to be used you will need to show your code, same if you want to provide a service, etc.

Then, because you want your code to be available to everyone, you need to take into consideration that some malicious users will be there looking for flaws in your code to take advantage of it.

Hope this helps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.