2

If someone created an erc20 token with the state variable uint256 totalSupply = 100, what is stopping another dev from creating a contract with that manipulates the totalSupply to 0?

Would making the state variable private or internal prevent this from happening?

Even so, couldn't that attacker make a contract: contract attackContract is totalSupply { and manipulate it that way?

^ Asking these questions because I want to make a smart contract that holds the total supply and can transfer tokens only via contracts with access to, set by the deployer.

1 Answer 1

2

What stops devs from changing supply of contracts?

Only one thing - others will see it in their code and simply avoid using that contract.


Would making the state variable private or internal prevent this from happening?

No, the access level of a state variable (private/internal/public) determines who can read it, not who can change it. The only one who can change a state variable in a contract instance are functions in that instance.


Even so, couldn't that attacker make contract attackContract is totalSupply and manipulate it that way?

You need to understand the difference between a contract and a contract instance:

A contract is just source code.

A contract instance is the bytecode of that contract deployed on the network.

Obviously, one contract can have many instances of it deployed on the network.

With contract A is B, when you create an instance of B, it is not going to extend any existing instance of A out there. It is going to be a "brand new" instance, which obviously cannot change the state variable of any existing instance.

7
  • Also, thank you for the great explanation :)
    – Lucus
    Dec 26, 2020 at 11:18
  • Ahh okay. So someone couldn't change their balance of that token or a mapping assigning an address to a boolean via a contract instance because they would need a function that does it in the source code, correct?
    – Lucus
    Dec 26, 2020 at 11:34
  • @Lucus: Yes, and since everything on the blockchain is public, such function would be visible for everyone to see. Dec 26, 2020 at 12:36
  • So a way to mitigate that would be to have functions that change important variables, such as a user's access status, would need to be restricted to onlyOwner, correct?
    – Lucus
    Dec 26, 2020 at 12:46
  • @Lucus: That depends on the specific requirements of the system. For example, the total-supply of an ERC20 token shouldn't even be allowed to be changed by only-owner functions (this is, if your goal is to implement an ERC20 token with a true valid financial implication). Dec 26, 2020 at 12:51

This site is temporarily in read-only mode and not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .