In the following documentation: https://web3js.readthedocs.io/en/1.0/web3-eth-contract.html
it says that in order to create a new contract from my script with web3 I have to use the "new" keyword and put the ABI code. Is this correct?
If yes, how does it exactly work? Let's consider the following situation:
- There is a contract platform, contract worker and interface IWorker where Worker is IWorker.
- Platform has an array of IWorker and there is a function AddWorker(address pAddress) which adds a IWorker(pAddress) to the array
- A user using MetaMask, which visits the website can anytime create a worker with simple click, change some variables, add it on the platform's array or remove
- Workers contain some variables and bool working, when it's false, owner can update variables, when true it's forbidden
- IWorker has isIdle() function and Worker overrides it with !working
- Worker is working (working == true) unless it's removed from the array.
- Platform reads getData(address, uint, uint) from worker and might do some work, sometimes even payable
Is attacker able to create a totally different contract with exactly same IWorker interface and even Worker body and same returning variables and be able to change them as he wants to even if this faked contract exists in my array? The simplest way to hack here would be to remove bool working and being able to dynamically update variables - is this possible?