4

Does putting p.executed = true after p.recipient.call() make this vulnerable to recursive calls?

function executeProposal(uint proposalNumber, bytes transactionBytecode) returns (int result) {
    Proposal p = proposals[proposalNumber];
    if (p.executed) throw;

    p.recipient.call.value(p.amount)(transactionBytecode);

    p.executed = true;

From ethereum.org/dao

  • 1
    What a terrible system. – Jeremy Banks Jun 18 '16 at 20:48
  • 1
    It's not terrible. Ethereum is new and everyone is still learning how to program on it. – dor Jun 18 '16 at 21:38
2

Yes!
the attacker would have to use a call in his wallets fallback function and call the function again so he will be able to detract the money within the same recursion call, before p.executed = true.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.