Comments (4)
Not a bug but a feature XD
from ink.
Not a bug but a feature XD
As discussed elsewhere.
I disagree. Because it is hard to impossible to know inside our macros whether any state mutating API is called downstream. We should not pretend that we actually know this. And talk about it in the docs, and even include a mutates
property in the metadata, pretending that we have knowledge about the mutability of our messages, when in fact, we can't reliably determine this.
solc
even prohibits state changes in view
functions on an assembly level. It makes us look bad if we pretend to have the concept of view functions.
We simply shouldn't sell guarantees we can't fulfill, especially if they can have security implications. What do we gain from having this in the metadata when it is in fact completely meaningless? In the current state, the only thing "immutable message" means is that the storage can't be written directly (but via a plethora of other ways, some of them intended).
Which is very missleading.
However, while currently not implemented, we could enforce this in the runtime. Akin to a staticcall
in the EVM: If the message dispatcher (the dispatcher knows which messages are supposed to be immutable) could flag to the runtime that from that point on, the contract want's the execution to revert upon calling into any state changing runtime API. The contract would still compile, however not work which would be an improvement and nullify the security concerns. Lints around this could additionally be provided.
from ink.
As discussed before, I think we should restrict the direct usage of ink::env
crate, and encapsulate Lazy
and Mapping
storage mutations with a higher-level interface that can infer mutability.
from ink.
As discussed before, I think we should restrict the direct usage of ink::env crate,
This doesn't solve the issue fully, but would be helpful in a lint.
Bottom line is we rely on the clients to do this correctly. The contracts-ui already honors it and fixed it in cargo contract. Additionally I am going to implement a static call flag in the contracts pallet so that contract to contract calls can have this guarantee.
from ink.
Related Issues (20)
- The function `set_contract_storage` in integration test it's missing a size check.
- Linter: Unprotected `terminate_contract`
- Linter: Unprotected `DelegateCall` call
- Add a lint for missing `no_main`
- IIP-3: Allow messages without `&self` receiver; opt out of automatic storage loading HOT 5
- Different gas value for `weight_to_fee()` in ink! integration and e2e tests HOT 6
- Split up `ink_linting` into two `dylint` libraries HOT 1
- Use standard Github's machines for test jobs
- Linter: Warn about using non-fallible APIs for `Lazy` and `Mapping` HOT 1
- Support expressions for `extension` and `function` during chain extension definition
- Event defintions with generics
- Deprecation of "legacy" inline events HOT 1
- Unify `call-runtime` and `e2e-call-runtime` examples
- Linter: Dangereous `self.env().transferred_value()` pattern
- Linter: Divide before multiply
- Add support and integration test for `caller_is_root`
- Migrate ink! CI from organization runners to standard GitHub runners
- Add links to linter warning details on use.ink
- Cross contract calling produces unsupported code HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from ink.