I’d like to know what is preventing me to write an assembly code who knows the contract address and call some arbitrary functions, even if declared “internal” via a simple JUMP.
In theory I can: 1) discover what is the location to jump to analyzing the bytecode and using some accessible address as baseaddress; 2) write my own assembly code which loads the needed parameters into the stack; 3) make a JUMP to the location discovered at (1).
What is the mechanism that should prevent me to do that?
(I understand that the various “call” type opcodes jump to the initial location of the called code, but apparently the JUMP and JUMPI instructions have no such limitation. Reading yellow paper sections 9.4.2 and 9.4.3 AND the Geth implementation apparently do not contradict the possibility to jump to an arbitrary absolute address, but for an unclear definition of “permitted jump range” which apparently simply requires that a JUMPDEST opcode be present in the location where the EVM jumps. And this is easy to find in the attacked contract opcode. Some further analysis is required and previous answer to similar questions is to much rough and straight and do not give evidences)