Etherscan "Write Contract" Tab - what is it for?

Question

What is the purpose of the Write Contract Tab in Etherscan?

For example, if you look up the QTUM Token Contract on Etherscan (https://bit.ly/2IsddkT) and then tap on the Write Contract TAB, you have before you all of that contract's Functions:

-approve

-transferFrom()

-transfer

etc.

And I mean they're not just simply listed there, you can actually interact with them, input values into them, etc.

Why?

Are you actually able to execute all of these functions? Meaning, perform the transferring of Tokens from some person's account to your account for example?

I assume - and hope - the answer for this is "no", but am I right or wrong about that?

Cause it certainly seems its about to let you do this:
-it lets you connect your account to that contract via MetaMask,
-it then lets you set values - like how many Tokens you want to transfer to your own account, etc.

I mean I haven't actually pulled the trigger on executing any of the available functions (I don't wanna risk throwing away ETHER or "experimentation") - but its certainly didn't look like it was going to stop me from doing so.

So, what's going on here? What's the point of having this Tab, and this ability to "write" to the contract?

Answer 1

You're right, but there's more.

Those are writable functions in the smart contract. This is the interface a "wallet" communicates with.

If you're not a developer, then this might seem a little abstract. Smart contracts expose functions that accept inputs and return results. In between, they can manipulate the contract's internal storage, called "state", calculate things, check things, or call upon functions in other contracts. It's a versatile language.

Normally, those functions are utilized by a user interface (UI) or a server that reads/writes the contract. In other words, it's more of a developer's interface than a user interface. However, contract security design always proceeds on the assumption that the user (or attacker) may communicate with the raw interface. One way to do so is the method you have discovered.

Are you actually able to execute all of these functions?

You can try.

Whether you succeed or not depends on how the contract is written. You will have to sign a transaction, and the contract will know who signed (called msg.sender in the code). It shouldn't let you transfer or approve funds you don't have.

For emphasis, security and what or isn't allowed is always a contract-level concern because a hostile user will simply not use the given UI if the UI is the only thing stopping bad behavior.

Following common sense and a common understanding of what a token should do, checking the sender's balance is probably a first step for such a contract.

At line 66 in the contract: https://etherscan.io/address/0x9a642d6b3368ddc662CA244bAdf32cDA716005BC#code

if (balances[msg.sender] >= _value && _value > 0) {

For the transfer to proceed, the sender's balance must be at least as much as the amount to transfer and the amount to transfer must be more than zero. So, if you have enough tokens, it will work.

Hope it helps.

Answer 2

So let me get this straight... I find a wallet that has say 1000 Aave tokens, and I open the "Write Contract" tab on the etherscan page for the Aave contract, scroll down to "Transfer Tokens" menu, enter the address for the aforementioned wallet as the Sender's address and my wallet's address for the Recipient, and then enter an Value as 10, hit "Write", approve the transaction in my web3 wallet, then those tokens should be transferred from the address with the 1000 Aave to my address automatically?? Or are there safeguards to prevent this?? Is the responsibility of assurance this isn't possible left up to the contract itself?? Does the sender not have to approve the transaction??

The way it sounds from comments here, as long as the contract doesn't have a specific measure to stop this (which it could possibly not have), then those tokens would be transferred to my wallet pretty simply.... I would assume if it were this easy then there would be more theft of this kind, right?! There's no way its this simple... right?!