3

There is this warning on the solidity documentation (https://solidity.readthedocs.io/en/v0.4.24/types.html)

I understand the part about stack depth limitation of 1024 and transaction failure when it runs of gas.

Why does this warning specifically warns about caller forcing the stack depth problem and causes transaction as an unsafe ether transfer? If the caller intentionally fails the send transaction which will result in a rollback, what harm could it do to the smartcontract or the recipient?

Is this some attack vector that is so obvious which I don't understand?

enter image description here

2

The warning you cited addresses the following scenario:

  1. Alice calls smart contract
  2. While processing the call smart contract decides to update its state and send some ether to Bob; updating the state is necessary to ensure that Bob will not receive payment twice
  3. Smart contract updates state
  4. Smart contract tries to send ether to Bob
  5. Ether transfer fails due to gas or stack depth limit
  6. Smart contract doesn't notice transfer failure and doesn't revert the transaction

Now smart contract's state is updated, so Bob is not eligible for payment anymore, but hit actually didn't receive his ether.

Alice may force such scenario by calling smart contract with little gas or stack depth left.

1

If you are curious about the reasons for adding a transfer or sender you may follow an original discussion about the feature.

https://github.com/ethereum/solidity/issues/610

You can see that transfers are prioritized and are thought to be safer than send

  • thanks for pointing me to the discussion thread but I still don't see how one is more dangerous than the other. Especially both has a stipend of 2300 gas and it is not adjustable. – Thomas Jul 21 '18 at 13:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.