First time writing a smart contract , please help me check are there any vulnerability in my code

Question

This is the first time I write a smart contract and I'm going to use it for real application , so I hope there isn't any vulnerability or exploit since smart contract is immutable This contract able to receives transaction from any address but only the owner eligible to withdraw

pragma solidity ^0.4.17;

contract EtherTransferTo{
address public owner;

constructor() public {
owner = msg.sender;
}

modifier onlyOwner() {
    require (msg.sender == owner);
    _;

}

function () payable public {
    // nothing to do!
}

function getBalance() public view returns (uint256) {
    return address(this).balance;
}

function withdraw(uint amount) onlyOwner returns(bool) {
    require(amount <= this.balance);
    owner.transfer(amount);
    return true;

}


}

I know it is stupid to ask for help like this , but there isn't any friends of mine know programming , much appreciate if anyone could help

Answer 1

Well, not exactly a vulnerability, but something that will put you in a very "uncomfortable" situation at some later point, is the fact that once deployed, you cannot change the owner of your contract.

This means that whatever private key you deploy this contract with - you could never replace.

And it leaves you with the following problems:

1. The private key owner retires from the company (for whatever reason), but will forever be able to withdraw money from the contract.
2. The contract is secured by a single key, which if stolen, can lead to the entire fund being drained out. The typical solution for that, is to replace ownership immediately after deployment, from yourself to a multi-sig contract (see example here). With your current implementation, you will not be able to do so.

Second thought, both problems are definitely under the category of vulnerability.

The typical solution is to provide an infrastructure for replacing the initial owner.

The good news are that you don't have to implement it yourself.

See contract Ownable by OpenZeppelin.