Questions tagged [reentrant-attacks]
Questions related to "reentrancy vulnerability" or "reentrant attack", where untrusted code reenters a contract and manipulates state. http://forum.ethereum.org/discussion/1317/reentrant-contracts https://github.com/LeastAuthority/ethereum-analyses/blob/master/GasEcon.md
12
questions
50
votes
3
answers
10k
views
What is a recursive calling vulnerability?
What is a recursive calling vulnerability exactly?
When creating smart contracts, DAOs or DAPPs, what measures can I take to ensure I am not vulnerable?
- 603
19
votes
1
answer
4k
views
How much computation can be done in a fallback function?
Simply sending Ether to a contract, will run the contract's code. In Solidity, this code maps to what it calls the fallback function.
How much work can be done in a fallback function?
eth♦
- 85.7k
20
votes
2
answers
9k
views
Is transfer() still safe after the Istanbul update?
In other words, is using transfer() safe?
function transfer(address contractB) public
{
contractB.transfer(1000);
//balances[msg.sender] -= 1000;
}
How about using call.gas?
function ...
- 469
22
votes
3
answers
4k
views
TheDAO hack FAQ: How did the attack happen on 17 June 2016?
Can anyone explain that how the DAO attack happened? Vitalik Buterin explained here that it was performed by splitting a DAO from the main DAO but calling the split function recursively.
We know that ...
14
votes
1
answer
2k
views
What does `call.value` mean and how did it allow the attack to The DAO?
I'm trying to get some sense from the hysteria around the attack performed to The DAO smart contract.
I understand the high level explanations, but I'd like to grasp how this attack was performed.
I'...
- 2,481
8
votes
1
answer
2k
views
Callstack attack
If my contract has a payout function like this
address bossAddress;
address employeeAddress;
uint256 bossSalary;
uint256 employeeSalary;
function payout (){
if (msg.sender==bossAddress){
...
- 1,036
7
votes
2
answers
2k
views
How was the recursion created that lead to theDAO hack?
I understand that if theDAO contract has a withdrawal function that sends money to contract X - contract X can be malicious and use the fallback function to call the withdrawal function again. However ...
- 7,616
5
votes
4
answers
594
views
In simple terms, how did the DAO get hacked and funds removed from it?
How did the DAO get hacked? Can someone explain in simple terms?
- 4,800
1
vote
0
answers
31
views
Can I trust that the value of address(this).balance is up-to-date if the function that transfers eth based on it is under a re-entrancy attack?
Is this function a secure way of transferring the locked value to the winner?
function resolve(bool _chooseHead, uint _randomNumber) public {
require(msg.sender == partyA);
require(keccak256(...
- 1,179
1
vote
3
answers
791
views
How can I defend against a reentrancy attack?
I studied The DAO attack.
Ethereum's reentrancy attack is still working.
but the Ethereum network also still works ( Sure, the compiler says "warning" )
How do you believe your contract will ...
- 13
0
votes
1
answer
360
views
How does reentrancy work?
I do not understand how transaction are processed sequentially and reentrancy attacks can still happen. Can someone explain this?
0
votes
1
answer
217
views
Does reentrancy attack happens as soon as the balance in storage is modified after the withdrawal?
I just saw something like this:
function sub(
uint a,
uint b
)
internal
pure
returns (uint)
{
require(b <= a, "SUB_UNDERFLOW");
return a - b;
}
function withdraw(...
- 1,018