0

This is the first time I write a smart contract and I'm going to use it for real application , so I hope there isn't any vulnerability or exploit since smart contract is immutable This contract able to receives transaction from any address but only the owner eligible to withdraw

pragma solidity ^0.4.17;

contract EtherTransferTo{
address public owner;

constructor() public {
owner = msg.sender;
}

modifier onlyOwner() {
    require (msg.sender == owner);
    _;

}

function () payable public {
    // nothing to do!
}

function getBalance() public view returns (uint256) {
    return address(this).balance;
}

function withdraw(uint amount) onlyOwner returns(bool) {
    require(amount <= this.balance);
    owner.transfer(amount);
    return true;

}


}

I know it is stupid to ask for help like this , but there isn't any friends of mine know programming , much appreciate if anyone could help

1 Answer 1

0

Well, not exactly a vulnerability, but something that will put you in a very "uncomfortable" situation at some later point, is the fact that once deployed, you cannot change the owner of your contract.

This means that whatever private key you deploy this contract with - you could never replace.

And it leaves you with the following problems:

  1. The private key owner retires from the company (for whatever reason), but will forever be able to withdraw money from the contract.
  2. The contract is secured by a single key, which if stolen, can lead to the entire fund being drained out. The typical solution for that, is to replace ownership immediately after deployment, from yourself to a multi-sig contract (see example here). With your current implementation, you will not be able to do so.

Second thought, both problems are definitely under the category of vulnerability.

The typical solution is to provide an infrastructure for replacing the initial owner.

The good news are that you don't have to implement it yourself.

See contract Ownable by OpenZeppelin.

2
  • Thank you so much ! Btw should I implement safemath library in this contract?
    – jent
    Oct 1, 2018 at 9:54
  • @jent: what do you mean by "implement safemath library in this contract"??? If you want to implement any other library or contract then you can go ahead, but it will obviously be independent of this contract. Did you mean "use safemath library in this contract"? If yes, then - do you know what safemath is used for? Oct 1, 2018 at 10:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.