0

I read about Wallet Griefing attack at the following link:

[Ethereum Griefing Wallets][1]

'send' is checked but contract uses throw. The code is given below:

for (uint i=0; i<investors.length; i++) {
  if (investors[i].invested == min_investment) {
    // Refund, and check for failure. 
    // This code looks benign but will lock the entire contract
    // if attacked by a griefing wallet.

    if (!(investors[i].address.send(investors[i].dividendAmount))) 
      { 
        throw;
      }
    investors[i] = newInvestor;
  }
}

Can this attack still occur by replacing throw with revert?

Somebody please guide me? Zulfi.

0

Yes, this vulnerability is still a fairly common mistake I see. I actually just wrote an article about it a couple weeks ago: https://medium.com/consensys-diligence/provable-fair-ransom-1547ba894d0.

Whether it's throw, require, or revert doesn't matter. The point is that if one recipient can cause the transaction to revert, no one can get paid.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.