0

I am reading the following stuff from the research paper at: Restricted Transfer

We define a property that guarantees that ether transfers (via call) cannot be invoked by any user a. Violation of this property can detect Ponzi schemes [20]. Our compliance pattern requires that for all users, invocations of that call instruction do not transfer ether. Our first violation pattern checks if the call instruction transfers non-zero amount of ether and its execution is independent of the sender. For the second violation pattern, the amount of ether transferred depends on the transaction data (and thus can be set to a non-zero value), while the execution is independent of this data (and will thus take place).

It look like that the tool (Securify) eliminates transfers by 'call' by declaring them vulnerable. If this is the case then what are the other ways of transferring Ether at the bytecode level?

Zulfi.

0

The concern is not that call is broken, but that call can be exploited if human error takes place. Writing a smart contract is considered potentially dangerous due to unexpected consequences that you have not planned for. This tool is trying to eliminate these errors by not allowing for transfers in the traditional way so that the users will not potentially create flawed executions.

Call can be used to run any code on Ethereum. If the contract is setup properly, you can call code on the blockchain and the code can handle someone else accessing the code properly.

It seems this tool is just a way of abstracting security as we know it. Not due to flaws in the code, but due to flaws in how we write the code. It bridges the bytecode by instead of giving users choice in how they write code, to instead allow you to use very closed templates that should be known to not fail in execution or have flaws.

All code is vulnerable if not used properly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.