Linked Questions
21 questions linked to/from What is a recursive calling vulnerability?
19
votes
1
answer
4k
views
How much computation can be done in a fallback function?
Simply sending Ether to a contract, will run the contract's code. In Solidity, this code maps to what it calls the fallback function.
How much work can be done in a fallback function?
eth♦
- 85.7k
1
vote
0
answers
91
views
What causes re-entrancy attacks? [duplicate]
I’ve seen a lot of projects be hit with re-entrancy attacks caused by flash loans, what is the main process behind these attacks?
- 19
14
votes
1
answer
2k
views
What does `call.value` mean and how did it allow the attack to The DAO?
I'm trying to get some sense from the hysteria around the attack performed to The DAO smart contract.
I understand the high level explanations, but I'd like to grasp how this attack was performed.
I'...
eth♦
- 85.7k
12
votes
1
answer
3k
views
How does the stack depth attack make a send() silently fail?
From a blogpost on security from Christian Reitwiessner:
Because of the maximal stack depth of 1024 the new bidder can always increase the stack size to 1023 and then call bid() which will cause the ...
eth♦
- 85.7k
4
votes
1
answer
146
views
Did the spamming counter-attack on The DAO attack work to slow down the attacks?
This question was asked in the comment section of What does TheDAO counter-attack by spamming actually do? (suggested by Stephan Tual).
Background links:
The attacks used a recursive call ...
eth♦
- 85.7k
40
votes
2
answers
26k
views
How do I convert my The DAO tokens into ethers using the withdrawal contract after the hard fork?
The DAO contract was attacked on 17th June 2016 where the attacker drained about USD 50 million worth of ethers using a recursive call vulnerability in The DAO contract code.
The attacker drained ...
eth♦
- 85.7k
5
votes
2
answers
518
views
Can I execute a contract function by sending a regular transaction to the contract?
I'd like to accept regular transactions to a contract and record a mapping address -> value. Is it possible to achieve it?
- 9,943
15
votes
2
answers
6k
views
How to conditionally send ethers to another account post-hard-fork to protect yourself from replay attacks
The DAO contract was attacked on 17th June 2016 where the attacker drained about USD 50 million worth of ethers using a recursive call vulnerability in The DAO contract code.
The attacker drained ...
- 40.3k
22
votes
3
answers
4k
views
TheDAO hack FAQ: How did the attack happen on 17 June 2016?
Can anyone explain that how the DAO attack happened? Vitalik Buterin explained here that it was performed by splitting a DAO from the main DAO but calling the split function recursively.
We know that ...
8
votes
1
answer
2k
views
Callstack attack
If my contract has a payout function like this
address bossAddress;
address employeeAddress;
uint256 bossSalary;
uint256 employeeSalary;
function payout (){
if (msg.sender==bossAddress){
...
CommunityBot
- 1
2
votes
1
answer
395
views
Reproducing recursive call exploit
Here's a contract that I want to attack using recursive call:
contract Abstract {
function foobar();
}
contract B {
uint stateVar;
function foo(Abstract someAddress){
...
CommunityBot
- 1
7
votes
2
answers
2k
views
How was the recursion created that lead to theDAO hack?
I understand that if theDAO contract has a withdrawal function that sends money to contract X - contract X can be malicious and use the fallback function to call the withdrawal function again. However ...
CommunityBot
- 1
9
votes
1
answer
917
views
How many ethers have been drained through the recursive call attacks on The DAO?
The recursive call attacks on The DAO have now stopped as there are no more ethers in The DAO account.
What are the amounts and percentages that can be attributed to the hostile and friendly attacks, ...
CommunityBot
- 1
6
votes
1
answer
124
views
Could a proxy spigot contract have stopped the DAO fraud?
For anyone who doesn't know about the DAO exploit you can read up on it here.
It seems to me like the attack could have been stopped if payouts went through another contract that was really simple ...
CommunityBot
- 1
5
votes
4
answers
594
views
In simple terms, how did the DAO get hacked and funds removed from it?
How did the DAO get hacked? Can someone explain in simple terms?
CommunityBot
- 1
6
votes
1
answer
662
views
Is address.send() not vulnerable for the recursive call attack?
If my dapp sends ether to another address via the send() method is it not vulnerable for the recursive call attack due to the limited amount of gas of 21000? Or should I still take precautions?
CommunityBot
- 1
6
votes
2
answers
891
views
What was the second vulnerability used in The DAO attack on 17 June 2016?
From The big theDAO heist FAQ by koeppelmann:
How did the attack worked exactly? The attacker managed to combine 2 exploits. The first exploit was to call the split DAO function recursively. That ...
CommunityBot
- 1
3
votes
1
answer
395
views
Which split proposal was used to mount the recursive call vulnerability attack on The DAO?
I'm assuming that a split proposal was used to mount the recursive call vulnerability attack on The DAO.
Which of the splits below was used to mount this attack?
Here are the current list of splits:
...
CommunityBot
- 1
3
votes
1
answer
479
views
Which accounts are involved in mounting the recursive call vulnerability attacks on The DAO?
The first transaction 0x0ec3f2488a93839524add10ea229e773f6bc891b4eb4794c3337d4495263790b was initiated from account 0x969837498944ae1dc0dcac2d0c65634c88729b2d to the contract at ...
CommunityBot
- 1
3
votes
1
answer
530
views
How was the recursive call vulnerability attack conducted via proposal #59 when there were no Yes votes?
From Which split proposal was used to mount the recursive call vulnerability attack on The DAO?, proposal #59 is very likely the vector uses by the attacker to hack 3,641,694.241898506 Ether ($59,578,...
CommunityBot
- 1
8
votes
1
answer
586
views
Is there any way to determine how long it took for the DAO attacker to deploy the attack?
Yeah, we heard that the DAO has been attacked. I am so curious about how long it took for the attacker to perform the whole transactions?
- 40.3k