You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository has been archived by the owner on Dec 31, 2024. It is now read-only.
I consider this to be a security issue because it is super easy to not realize that this is the behavior and result in potentially not calling a method that should have been called, yet returning a well defined value. This could allow a clever attacker to get a script to do what they want.
This prints 2, should throw. Changing value = 0 to value = 2 results in the same behavior.
from ethereum import tester
import serpent
code = """
def foo():
return 5
def bar():
result = self.foo(value = 0)
return result + 2
"""
state = tester.state()
state.block.number += 2000000
contract = state.abi_contract(code)
print contract.bar(value = 1)
The text was updated successfully, but these errors were encountered:
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.
I consider this to be a security issue because it is super easy to not realize that this is the behavior and result in potentially not calling a method that should have been called, yet returning a well defined value. This could allow a clever attacker to get a script to do what they want.
This prints
2
, should throw. Changingvalue = 0
tovalue = 2
results in the same behavior.The text was updated successfully, but these errors were encountered: