2

If someone created an erc20 token with the state variable uint256 totalSupply = 100, what is stopping another dev from creating a contract with that manipulates the totalSupply to 0?

Would making the state variable private or internal prevent this from happening?

Even so, couldn't that attacker make a contract: contract attackContract is totalSupply { and manipulate it that way?

^ Asking these questions because I want to make a smart contract that holds the total supply and can transfer tokens only via contracts with access to, set by the deployer.

Improve this question
2

What stops devs from changing supply of contracts?

Only one thing - others will see it in their code and simply avoid using that contract.

Would making the state variable private or internal prevent this from happening?

No, the access level of a state variable (private/internal/public) determines who can read it, not who can change it. The only one who can change a state variable in a contract instance are functions in that instance.

Even so, couldn't that attacker make contract attackContract is totalSupply and manipulate it that way?

You need to understand the difference between a contract and a contract instance:

A contract is just source code.

A contract instance is the bytecode of that contract deployed on the network.

Obviously, one contract can have many instances of it deployed on the network.

With contract A is B, when you create an instance of B, it is not going to extend any existing instance of A out there. It is going to be a "brand new" instance, which obviously cannot change the state variable of any existing instance.

Improve this answer
7
  • Also, thank you for the great explanation :) – Lucus Dec 26 '20 at 11:18
  • Ahh okay. So someone couldn't change their balance of that token or a mapping assigning an address to a boolean via a contract instance because they would need a function that does it in the source code, correct? – Lucus Dec 26 '20 at 11:34
  • @Lucus: Yes, and since everything on the blockchain is public, such function would be visible for everyone to see. – goodvibration Dec 26 '20 at 12:36
  • So a way to mitigate that would be to have functions that change important variables, such as a user's access status, would need to be restricted to onlyOwner, correct? – Lucus Dec 26 '20 at 12:46
  • @Lucus: That depends on the specific requirements of the system. For example, the total-supply of an ERC20 token shouldn't even be allowed to be changed by only-owner functions (this is, if your goal is to implement an ERC20 token with a true valid financial implication). – goodvibration Dec 26 '20 at 12:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.