1

I have a contract A calling another contract B

Contract A

contract A {

   function sendValue(B _externalContract, uint _value) {
     _externalContract.acceptValue(_value);
   }
}

contract B {
   function acceptValue(unit value);
}

Contract B (contract A expect contract B acceptValue to be safe)

  contract B {
       function acceptValue(unit _value) {
         dosomethingWith(_value)
       }
    }

If a malicious user now design contract B function acceptValue to self destruct like so

Contract B

  contract B {
       function acceptValue(unit _value) {
         selfdestruct(msg.sender);
       }
    }
  • Will that function destroy my contract A or malicious user Contract B?
  • Is there a check I can perform in contract A sendValue to prevent that?
1
  • In your code sample, Contract B would be destroyed via selfdestruct(...). The only case where Contract A would be destroyed is if Contract A would have done a delegatecall to Contract B. delegatecall would borrow the function from Contract B and run it in the context of Contract A.
    – CJ42
    Apr 26, 2022 at 9:20

1 Answer 1

4

It destroys Contract B and sends B's Eth balance to contract A, if called from A.

There is no way B can destroy A. Otherwise, there would be chaos.

Hope it helps.

UPDATE and PSA

If I'm not mistaken, if A uses delegatecall to B and B executes selfdestruct in the context of A then A will destroy itself. It's incredibly dangerous to use delegatecall with contracts that are not known and trusted. The documentation hints at that but the warning might not be clear to everyone.

The example doesn't use delegatecall so it's still not possible for a maliceous B to harm A but the PSA is help prevent anyone who comes across this answer from extrapolating the assurance in an unsafe way.

2
  • But there is - Chaos.
    – Doodloo
    Jun 7, 2022 at 15:44
  • 1
    Updated the answer with a PSA Jun 7, 2022 at 18:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.