Proxy function clashing - what kind of danger comes exactly with it?

Question

I read that if I am using proxy, there is a chance of function clashing. Let's say in my contract there is a function with a signature:

proxyOwner()
025313a28d329398d78fa09178ac78e400c933630f1766058a2d7e26bb05d8ea

Now, as I understand correctly, a hacker can perform a loop on his computer and create a special function with signature:

clash550254402()
025313a2bba9fda619061d44004df81011846caa708c8d9abf09d256021e23ee

Both signatures are same: 025313a2

What exactly can a hacker do with this? He can call the function directly anyway. What kind of danger comes with function clash? If my function isn't view, what unexpected can be happened?

In my contract in the proxy's update proxy address I'm checking if sender exist in the registry contract as an allowed to make any changes. Still, do I need to implement zeppelin's transparent proxy to prevent clashing? Why?

Answer 1

Suggest the following article could answer some of your questions: https://medium.com/nomic-labs-blog/malicious-backdoors-in-ethereum-proxies-62629adf3357

If you have questions about ZeppelinOS you can join us in the forum https://forum.zeppelin.solutions/

Answer 2

The article posted on Medium by Patricio Paladino hardly conveys a straightforward explanation or demonstration of how this kind of attack is executed. You can refer to this following article which does mention some use cases that can be exploited by this characteristic of Ethereum Proxies and explain how this attack works in simple words with pictures. Feel free to take a look here.

Answer 3

I know this is an old question, but this might help if someone is bumping into this question just now.

Due to my understanding, the attack can be carried out by the owner of the proxy. This means, for example, the proxy contract can point to an implementation contract which is trusted by many people to do the correct job, lets imagine this implementation contract has the function proxyOwner(). The malicious proxy owner can embed another function that has the same signature to proxyOwner() such as clash550254402() inside the proxy contract that is pointing to the trusted implementation contract. This can cause users calls that are aiming to execute proxyowner() from the implementation contract to not get past the proxy contract and run clash550254402() instead!