web3: How does deploy new contract work? Can attacker fake my worker contract?

Question

In the following documentation: https://web3js.readthedocs.io/en/1.0/web3-eth-contract.html

it says that in order to create a new contract from my script with web3 I have to use the "new" keyword and put the ABI code. Is this correct?

If yes, how does it exactly work? Let's consider the following situation:

• There is a contract platform, contract worker and interface IWorker where Worker is IWorker.
• Platform has an array of IWorker and there is a function AddWorker(address pAddress) which adds a IWorker(pAddress) to the array
• A user using MetaMask, which visits the website can anytime create a worker with simple click, change some variables, add it on the platform's array or remove
• Workers contain some variables and bool working, when it's false, owner can update variables, when true it's forbidden
• IWorker has isIdle() function and Worker overrides it with !working
• Worker is working (working == true) unless it's removed from the array.
• Platform reads getData(address, uint, uint) from worker and might do some work, sometimes even payable

Is attacker able to create a totally different contract with exactly same IWorker interface and even Worker body and same returning variables and be able to change them as he wants to even if this faked contract exists in my array? The simplest way to hack here would be to remove bool working and being able to dynamically update variables - is this possible?

Answer 1

The new keyword and the ABI is not how you deploy a smart contract on the blockchain in Javascript with web3. Creating a new smart contract is called 'deploying'. You can read how to deploy a new smart contract in the 'deploy' section of the web3 documentation:

https://web3js.readthedocs.io/en/1.0/web3-eth-contract.html#deploy

If the AddWorker function does not check the source code of the specified Worker contract and you allow users to pass any address to AddWorker, then yes, an attacker can add any smart contract they want.

There are two ways to prevent users from adding a smart contract you don't want them to add:

• Instead of just an AddWorker function, have a CreateWorker function in your platform smart contract. You can deploy a smart contract in Solidity by using the Solidity new keyword. Then you can require that worker contracts were created by your platform contract. Something like this:

  mapping(address => boolean) private validWorkers;
  function CreateWorker()
  {
      address newWorker = new Worker();
      validWorkers[newWorker] = true;
  }
  
  function AddWorker(address _addr)
  {
      // Require that the worker was created from the CreateWorker function
      require(validWorkers[_addr]);
  
      // ... add to array ...
  }
  

• Copy the source code from the submitted contract address, and verify that its source code is 'allowed' to be added to your workers array. You can do this using the EVM's CODECOPY instruction. If you use this method, the platform contract will also have to verify that the user's contract initialized the storage variables correctly.