重入漏洞

Question

大家好，我注意到优惠函数使用.call {value: amount} (“”) 方法将以太币发送到收件人的地址.

谁能深入了解该功能是否确实容易受到重入的影响，并提出任何最佳做法或修改以降低此类风险吗？

function _offer(address to, uint256 amount) internal {

      balance -= amount;

      (bool success, ) = to.call{value: amount}("");
      if (!success) {
          revert TransferFailed(address(0), address(this), to, amount);
      }
  }

0x0304...a958 · Answer

One of the best practice in Solidity is CEI (Checks, Effects, Interactions). It describes the order of how your code is structured to avoid unexpected behaviour or malicious execution. Checks would be implementing some require to be sure the parameters in your function are correct. There isnt any in your _offer() function, but you could add for exemple require(balance >= amount); (not necessary) at the beginning of your function to be sure that the user doesnt spend more than what he owns. Effects are basically changing the state variables of your contract in order to suit what you want it to be now. Here, its the line balance -= amount;, reducing the users balance. Interactions are calls to other contracts/addresses that might trigger some unknown code (for exemple when you call to send money, it might trigger a receive() function of the smart contract calling your function). Because you follow this rule in this code, no re-entrancy should be possible.

重入漏洞

答案

你知道答案吗？