0

What implications can it have to the security of a function if the content of it is wrapped into try-catch statements?

  • Too general; Please provide a concrete coding example and refer to it specifically. – goodvibration Jun 15 at 15:24
1

It is a very general question, so a very general answer.

Try-catch is a logical branching technique, and logic errors can have serious security implications.

What implications can it have to the security of a function

A function should always do exactly what it is supposed to do, in all cases. That should be obvious. It is not always wrong to try-catch, but it is worth noting that thousands of contracts do just find without it. Consider that failure is often the correct thing to do and "Fail early and fail hard" is a best practice.

I would treat it as a dog -whistle that suggests something wrong might be here, because:

  1. If calling another contract and that contract errors e.g. someone didn't actually get paid, then failing the whole transaction is usually the right thing to do. Why are they catching it and soldiering on?
  2. If internal, what is so disorganized that they feel the need to catch internal errors, and why is soldiering on the right thing to do?
  3. Is there no way to prevent the situation that leads to the error they are trying to catch, and why haven't they done that?
  4. Is there more than one way to create an error and can the contract be tricked into "catching" something, and soldiering on, in a case where stopping would have been the right thing to do?

Try-catch may be a band-aid put over something that should have been fixed at the root cause level. Of course, no one can say the logic is automatically defective merely because a blunt instrument has been used.

Hope it helps.

| improve this answer | |
  • 1
    awesome answer, aligns perfectly with the principles of KISS which we should thrive to uphold. – NowsyMe Jun 15 at 19:45

Not the answer you're looking for? Browse other questions tagged or ask your own question.