2

Its possible to use tx.origin instead of msg.sender to block the contracts from playing and revert the calls?

6

Yes. Add require(tx.origin == msg.sender); to any methods that you don't want to be callable from contracts (this will also block users with multisig wallets).

Bear in mind though that whilst this works now, there are plans in the works to eliminate the distinction between contract and regular accounts, and whilst there is still debate about how this will work, if it works well, there will no longer be a way to tell the difference.

2

While you could certainly do that, you should have in consideration what @james_pic said.

Another way to know if the caller is a contract or an EOA is using this method:

function isContract(address addr) returns (bool) { uint size; assembly { size := extcodesize(addr) } return size > 0; }

EDIT: Have in mind that, as @james_pic pointed out, with the approach above if a malicious contract calls your contract in its constructor, then extcodesize will be zero, but it will still be able to revert the transaction.

  • 1
    This is not safer. If a malicious contract calls your contract in its constructor, then extcodesize will be zero, but it will still be able to revert the transaction. This is broken now, whereas my approach may become broken later. – James_pic Jun 2 '18 at 14:14
  • @James_pic yep, you are correct. Changing my answer now. – pabloruiz55 Jun 2 '18 at 14:34
  • so to attack the function the attacker have to deploy contracts in a brute force manner until he get what he wants correct? – hugofreire Jun 2 '18 at 14:44
  • 1
    @hugofreire It really depends on what the attack model is. If it's a gambling contract, the attacker can deploy contracts that roll the dice in their constructor, then rollback the transaction if they don't win. If it's just a coin toss, then they'd only have to do this twice, on average. Also note that the attacker can save a lot of gas by calling selfdestruct in the constructor, which prevents the contract actually saving its code to the blockchain, but doesn't roll back the transaction. – James_pic Jun 3 '18 at 9:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.