fergarrui / ethereum-security Goto Github PK

In ReentrancyVulnerableFixed.sol, function WIthdrawAll().

balances[msg.sender] is set to zero before the transaction is made. The variable that should be used is "amount".

https://gist.github.com/Dexaran/ddb3e89fe64bf2e06ed15fbd5679bd20

ethereum/solidity#2630

The example of this will be nice.

Any contract is intended to receive Ether in payable functions only. Thus, there could be contracts that rely on fact that their balance can only be increased through payable functions that are implemented at this contract.

It is not absolutely accurate because it is possible to throw an amount of Ether into a certain address via the SELFDESTRUCT opcode.

contract SuicideDeliverer
{

    function() payable { }

    function deliverTo(address _addr)
    {
        suicide(_addr);
    }
}

This can deliver Ether to a contract at _addr address without a proper handling. It can violate the internal contract logic, if the contract is based on the assumption that it can only accept Ether properly through calls of "payable" functions.