Vulnerabilidad de reingreso

Question

Hola a todos, he notado que la función de oferta utiliza el método .call {value: amount} («») para enviar Ether a la dirección del destinatario.

¿Alguien podría darnos una idea de si esta función es realmente vulnerable al reingreso y sugerir alguna de las mejores prácticas o modificaciones para mitigar dichos riesgos?

function _offer(address to, uint256 amount) internal {

      balance -= amount;

      (bool success, ) = to.call{value: amount}("");
      if (!success) {
          revert TransferFailed(address(0), address(this), to, amount);
      }
  }

0x0304...a958 · Answer

One of the best practice in Solidity is CEI (Checks, Effects, Interactions). It describes the order of how your code is structured to avoid unexpected behaviour or malicious execution. Checks would be implementing some require to be sure the parameters in your function are correct. There isnt any in your _offer() function, but you could add for exemple require(balance >= amount); (not necessary) at the beginning of your function to be sure that the user doesnt spend more than what he owns. Effects are basically changing the state variables of your contract in order to suit what you want it to be now. Here, its the line balance -= amount;, reducing the users balance. Interactions are calls to other contracts/addresses that might trigger some unknown code (for exemple when you call to send money, it might trigger a receive() function of the smart contract calling your function). Because you follow this rule in this code, no re-entrancy should be possible.

Vulnerabilidad de reingreso

Respuestas

Sabes la respuesta?