0

As per my understanding transactions are signed before sending to Ethereum. Else, no transfer of Ether will happen. However, messages sent to Smart Contracts (SC) aren't signed (e.g., using methods.myMethod.send). While this is a problem as anyone can call a SC, I understand that we can write SC in such a way that it responds only to a message coming from a given address. This way we can prevent any Ether or Token is not transferred to an attacker.

My question is, can an attacker send messages to a SC while masquerading an address (as there's no signature) that the SC is willing to accept? By doing so, can the attacker burn Ether of that account (as gas is consumed to execute SC)?

If so, any suggestions to prevent this.

  • 2
    No one can call a smart contract without sending a transaction, and every transaction has a signature. So the smart contract always knows the account that called it. The gas is paid for by the account that sent the transaction. – smarx Sep 13 at 5:12
  • My initial observations were due to trying smart contract calls on Ganache, which seems to be signing all transactions behind the scene. Now that I tried on Ropsten Testnet, all smart contract calls need to be explicitly signed. – Dilum Bandara Sep 20 at 3:03
0

However, messages sent to Smart Contracts (SC) aren't signed

No. All transactions are signed by an externally owned account (EOA).

Transactions sent to contracts are signed by an EOA.

A contract runs code, and that might include sending a message to another contract. In this case, the message is not signed because it doesn't need to be signed. The contract would only do that if it was responding to a transaction or message that can be traced back to a transaction signed by an EOA.

msg.sender is always the inner-most contract or EOA that invoked a function and there is no known may to impersonate another address. This is why it is used for access control.

Hope it helps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.