0

What is the purpose of the Write Contract Tab in Etherscan?

For example, if you look up the QTUM Token Contract on Etherscan (https://bit.ly/2IsddkT) and then tap on the Write Contract TAB, you have before you all of that contract's Functions:

-approve

-transferFrom()

-transfer

etc.

And I mean they're not just simply listed there, you can actually interact with them, input values into them, etc.

Why?

Are you actually able to execute all of these functions? Meaning, perform the transferring of Tokens from some person's account to your account for example?

I assume - and hope - the answer for this is "no", but am I right or wrong about that?

Cause it certainly seems its about to let you do this:
-it lets you connect your account to that contract via MetaMask,
-it then lets you set values - like how many Tokens you want to transfer to your own account, etc.

I mean I haven't actually pulled the trigger on executing any of the available functions (I don't wanna risk throwing away ETHER or "experimentation") - but its certainly didn't look like it was going to stop me from doing so.

So, what's going on here? What's the point of having this Tab, and this ability to "write" to the contract?

2 Answers 2

2

You're right, but there's more.

Those are writable functions in the smart contract. This is the interface a "wallet" communicates with.

If you're not a developer, then this might seem a little abstract. Smart contracts expose functions that accept inputs and return results. In between, they can manipulate the contract's internal storage, called "state", calculate things, check things, or call upon functions in other contracts. It's a versatile language.

Normally, those functions are utilized by a user interface (UI) or a server that reads/writes the contract. In other words, it's more of a developer's interface than a user interface. However, contract security design always proceeds on the assumption that the user (or attacker) may communicate with the raw interface. One way to do so is the method you have discovered.

Are you actually able to execute all of these functions?

You can try.

Whether you succeed or not depends on how the contract is written. You will have to sign a transaction, and the contract will know who signed (called msg.sender in the code). It shouldn't let you transfer or approve funds you don't have.

For emphasis, security and what or isn't allowed is always a contract-level concern because a hostile user will simply not use the given UI if the UI is the only thing stopping bad behavior.

Following common sense and a common understanding of what a token should do, checking the sender's balance is probably a first step for such a contract.

At line 66 in the contract: https://etherscan.io/address/0x9a642d6b3368ddc662CA244bAdf32cDA716005BC#code

if (balances[msg.sender] >= _value && _value > 0) {

For the transfer to proceed, the sender's balance must be at least as much as the amount to transfer and the amount to transfer must be more than zero. So, if you have enough tokens, it will work.

Hope it helps.

8
  • OK, a couple of things: I am a Developer, and so I do get the "abstract" stuff - but I'm still not clear on WHY the "Write Contract" Tab is being made available to us in the first place - which was my main question. It sounds like what you're saying is that hackers usually try to "attack" a Smart Contract by altogether skipping its UI/Front-End (typically a Website) and engaging directly with its "public" functions. OK, if that is indeed what you're saying, how is that related to why "Write Contract" is made available to us? What's the point of having it? So we can test vulnerabilities?
    – Mark55
    Feb 15, 2019 at 5:48
  • The situation is analogous to API endpoints. If contracts are going to have ABI, which they do, then it could be used for good or for evil because everyone will have access. Syncing the chain and using a CLI style or using a general-purpose GUI is a matter of convenience. It doesn't change the security guarantees coded in the contract. If you mean "Why make it convenient?" it roughly answers itself, no? Feb 15, 2019 at 15:51
  • Well, to answer your question: no, I did not ask "Why make it convenient?" Those are your words. What I was getting at was something else, which really comes down to etherscan's choice of wording - "Write Contract". Its misleading. Inaccurate. You're not "WRITING" a contract through that Tab. You're not editing it, adding or deleting code from it, you're not "writing" anything. You're INTERACTING with it. At best, you're writing TO it. So their wording is misleading - and that's why I asked "why is it there?" The Tab should really be called "Interact with Contract" and that would solve it.
    – Mark55
    Feb 15, 2019 at 18:25
  • Really, all they're doing here is what myEtherWallet has been letting you do through their "Contracts" Tab, which is let you pull up existing contracts and access and run individual functions from those contracts - through a drop-down menu. So in terms of etherescan's choice of wording for this Tab, Access Contract would be another good title.
    – Mark55
    Feb 15, 2019 at 18:28
  • "Are you actually able to execute all of these functions? Meaning, perform the transferring of Tokens from some person's account to your account for example?" did not imply the understanding you seem to have now. You'll have to ask them about their choice of wording in the UI. You should vote for the answer if you found it informative and accept it if it addressed the original question as it was written. Feb 15, 2019 at 20:31
0

So let me get this straight... I find a wallet that has say 1000 Aave tokens, and I open the "Write Contract" tab on the etherscan page for the Aave contract, scroll down to "Transfer Tokens" menu, enter the address for the aforementioned wallet as the Sender's address and my wallet's address for the Recipient, and then enter an Value as 10, hit "Write", approve the transaction in my web3 wallet, then those tokens should be transferred from the address with the 1000 Aave to my address automatically?? Or are there safeguards to prevent this?? Is the responsibility of assurance this isn't possible left up to the contract itself?? Does the sender not have to approve the transaction??

The way it sounds from comments here, as long as the contract doesn't have a specific measure to stop this (which it could possibly not have), then those tokens would be transferred to my wallet pretty simply.... I would assume if it were this easy then there would be more theft of this kind, right?! There's no way its this simple... right?!

2
  • usually, the contract checks if the transaction sender has approval from the owner of the wallet to send those tokens.
    – Majd TL
    Feb 3, 2021 at 8:27
  • 1
    Hi there. Please don't post questions in the answers section. Please post a new question. Feb 3, 2021 at 8:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.