-3

Lets say in solidity every time user pay_in to the contract we +1 the number of contributors and everyone the person withdrew we'll -1 the number of conterbuters.

Having made a contract that is doing just that, apparently if the user try to execute withdrew function quick enough they can get the number of conterbuters all the way to large number.

Wondering if there is any way to prevent this from happening.

PLEASE NOTE:

I am aware of overflow issue and the use of Mathsafe library. however using the mathsafe library in code is computationally expensive and its not going to help if user count can go from 100 to 97. providing one user execute the code 3 times before the completion of the first two transation. hence why i do not think this is a overflow problem.

update: Here is the simplified librery functions

/**
 * Deposit
**/
function deposit(Store storage self) public {
    require(msg.value > 0);
    address user = msg.sender;
    // we already have the user down as Contributor
    if(self.contributor[user].ether_in<=0)
        self.numContributors++;
    self.contributor[user].ether_in += msg.value;
    self.ether_in += msg.value;
}
/**
 * withdraw
**/
function withdraw(Store storage self) internal {
    address user = msg.sender;
    require(self.contributor[user].ether_in>0);
    ether_out = self.contributor[user].ether_in;
    self.numContributors--;
    user.transfer(ether_out);
    self.contributor[user].ether_in = 0
}

**Contact **

import './lib'
contract SimplifiedMainContract {

    using Lib for Lib.Store;
    Lib.Store private store;

    function deposit() public payable {
        store.deposit();
    }

    function withdraw() public {
        store.withdraw();
    }

}
  • Please share your (simplified) code – Lauri Peltonen Jul 11 '18 at 12:08
  • I know how to use SafeMath libery, I use it all the time... my issue is one user executing one function twice. – Arash Kiani Jul 11 '18 at 12:31
  • How are deposit and withdraw called? Perhaps you have a reentrancy attack, without an audit of the full code involved is hard to say anything. – Ismael Jul 11 '18 at 15:09
  • just added the calling contract – Arash Kiani Jul 11 '18 at 15:44
  • @ismael To understand reentrancy attack just looked into medium.com/@gus_tavo_guim/… . And if I understand correctly ... I dont think that the issue – Arash Kiani Jul 11 '18 at 15:59
3

You should google about overflowing/underflowing in variables and use SafeMath library where such calculations are needed, since Solidity hasn't built-in checks for such things.

|improve this answer|||||
  • Thats not my problem, I am trying to avoid making such costly calculations for a prefectly contained environments. – Arash Kiani Jul 11 '18 at 12:18
  • also we can still go down from 2 conterbuters to 0 using math safe – Arash Kiani Jul 11 '18 at 12:19
  • math.sub(x,y) is not the answer to my question! – Arash Kiani Jul 11 '18 at 12:22
  • Umm it's clearly underflow issue here? You are not checking contributors count before subtracting, so subtracting from 0 will result in very high number. Unless your problem is not that you get such high number. – Maxpeinas Jul 11 '18 at 12:24
  • No its not! its definitely double execution problem, where one user can execute one function multiple times! clearly with mathsafe we cant got lower then 0 but user can still make the contract go from 100 to 97 if they execute function 3 times. – Arash Kiani Jul 11 '18 at 12:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.