Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Permissive fallback function (low severity) #1

Open
Dexaran opened this issue Feb 5, 2018 · 0 comments
Open

Permissive fallback function (low severity) #1

Dexaran opened this issue Feb 5, 2018 · 0 comments
Labels

Comments

@Dexaran
Copy link
Member

Dexaran commented Feb 5, 2018

Severity: low

Code snippet

https://github.com/EthereumCommonwealth/ethereum-classic-multisig/blob/master/contracts/MultisigWallet.sol#L42-L46

Description

Permissive fallback function is an antipattern in smart-contract development due to specifics of Ethereum. It should be noted that event handling is a well-known and a standard practice in programming.
There is a range of smart-contract calls that behave as events and execute a handler function in the destination contract. For example: token transfer of token contracts, name owner change of naming services and so on. Many others may be added in future.

Permissive fallback function executes successfully whenever a third party contract is trying to call a function that does not exist in the multi-sig wallet. In this case, a third party contract may rely on event handler functions that are not implemented in multi-sig wallet but the execution will succeed.

According to solidity issue#2630, a fallback function function can return corrupted values, even though it does not have return values in fact, thus violating the work flow of third-party contracts.

NOTE: This can not hurt the multi-sig wallet contract or its funds. This can only hurt third-party contracts that will interact with the multi-sig wallet contract.

@Dexaran Dexaran added the audit label Feb 10, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

1 participant