,
6 tweets,
2 min read
Read on Twitter
Important turning point in the life of #ethereum's constantinople hard fork: medium.com/chainsecurity/…
A brief explanation follows, will take a few tweets.
In a smart contract transferring value to a recipient can be accomplished via the CALL operation. It is possible to configure this operation to send gas to the recipient.
In a smart contract transferring value to a recipient can be accomplished via the CALL operation. It is possible to configure this operation to send gas to the recipient.
If no gas is specified, then a fixed stipend of 2300 gas is sent. The recipient can be another contract. Solidity’s “transfer()” feature uses this.
Currently, it is not possible to make lasting changes in the state with 2300 gas. It possible to make a call to another contract or to issue events. Changing a storage entry costs 5000 gas.
After Constantinople however in certain cases changing a storage entry can be as low as 200 gas. One such case is when writing a “dirty” entry, i.e. an entry which had a value previously.
The attack here is that a malicious callee can change the storage of the caller during a transfer, if the caller doesn’t take precautions. The problem lies in the fact that smart contract developers operated under the assumption that “transfer()” was safe from reentrancy issues.
