0

Got this in pseudo-code (Solidity like...) from audit of past work of person from our company, in short it seems to be withdrawing first and adding later. Maybe not a good idea, especially since it's using "call" judging by the 34050 gas and not transfer?

function withdraw(uint256 amount) payable: 
  require amount <= balanceOf[msg.sender]
  balanceOf[msg.sender] -= amount
  call msg.sender with:
     value amount wei
       gas gas_remaining - 34050 wei
  if ext_call.success:
      log Withdrawal(
            address src=_wdamount,
            uint256 amt=caller)
      return 1
  require balanceOf[msg.sender] + amount >= balanceOf[msg.sender]
  balanceOf[msg.sender] += amount
  return 0
3
  • What exactly is your question ? Dec 18 '19 at 13:05
  • is it re-entrant? medium.com/coinmonks/…
    – Robert Ggg
    Dec 18 '19 at 13:07
  • Without the whole code and types we can only guess. Yes, it might be reentrant if coded poorly.
    – Ismael
    Dec 18 '19 at 13:47
0

is function like this one reentrant?

Is it vulnerable?

You are doing

  1. Checks
  2. Effects (except for the event)
  3. Interactions
  4. Undo changes on fail

On first look, I don't think it is, but ...

You did not check for underflow here, so msg.sender can overdraw their account and succeed.

balanceOf[msg.sender] -= amount;

That is probably the beginning of trouble.

Consider (in your style):

function withdraw(uint256 amount) payable: 
  require amount <= balanceOf[msg.sender]
  balanceOf[msg.sender].sub(amount)  // with safeMath
  log Withdrawal(
    address src=_wdamount,
    uint256 amt=caller)
  require
     call msg.sender with:
       value amount wei
       gas gas_remaining - 34050 wei
  return 1

Hope it helps.

2
  • Thanks Rob, but isn't the 2nd line indeed checking for this and hence preventing underflow? I mean this one "require amount <= balanceOf[msg.sender]" - Let's say a balance is 10 and user attempts 11 - it will fail since 11 is over the balance 10, thus also preventing underflow?
    – Robert Ggg
    Dec 19 '19 at 16:06
  • You are right. I overlooked that guard. Dec 19 '19 at 16:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.