Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [call-depth-attacks]

No longer possible with EIP 150. Questions related to "call depth attacks", sometimes called "call stack attack", that uses the EVM's depth limit of 1024 calls to trick contracts into believing something that may not have happened. https://github.com/LeastAuthority/ethereum-analyses/blob/master/GasEcon.md#callstack-depth-limit-errors

0
votes
1answer
214 views

Is there a difference between the call stack and the “normal” stack?

I cannot find any good source on this. The "normal" stack is where all PUSH opcodes put their bytes on. The "call stack" could be some other stack where either call data or addresses are put on - ...
0
votes
1answer
62 views

Is it still possible to reach call stack depth 1024?

In the past it was possible to reach call stack depth 1024 in EVM. However I heard that now it is impossible due to gas costs. Is this true?
3
votes
1answer
804 views

Are solidity contracts still vulnerable to callstack exploits?

I was reading the paper at http://www.comp.nus.edu.sg/~loiluu/papers/oyente.pdf and it mentions callstack bugs where since the call depth is set at 1024, a contract may be able to call itself 1023 ...
6
votes
1answer
191 views

Is there a way to reproduce a stack depth attack now?

I am trying to replicate the attack I found here: Reproducing stack depth attack contract Attacker { Victim public victimContract; uint x; function Attacker(){ victimContract = (new Victim)....
4
votes
2answers
381 views

Reproducing stack depth attack

Victim contract allows one time withdraw only. I want to attack it using stack depth attack to withdraw everything it has. I've tried different things, but can't get the desired result. Here's where I'...
3
votes
1answer
87 views

Reentrant attack number on 17 June 2016

This post What was the second vulnerability used in The DAO attack on 17 June 2016? say : And from the Q&A [...], each of the transactions (the first and second at least from my manual ...
8
votes
1answer
2k views

Callstack attack

If my contract has a payout function like this address bossAddress; address employeeAddress; uint256 bossSalary; uint256 employeeSalary; function payout (){ if (msg.sender==bossAddress){ ...
46
votes
3answers
7k views

What is a recursive calling vulnerability?

What is a recursive calling vulnerability exactly? When creating smart contracts, DAOs or DAPPs, what measures can I take to ensure I am not vulnerable?
11
votes
1answer
2k views

How does the stack depth attack make a send() silently fail?

From a blogpost on security from Christian Reitwiessner: Because of the maximal stack depth of 1024 the new bidder can always increase the stack size to 1023 and then call bid() which will cause the ...