two questions.
The problem is based on having a payable fallback calling withdraw in the attacker's sc. So first attacker initiates a withdraw, then his fallback is being called, withdraw is called again and so on.
Basically very first call stops at 9th line of code and awaits for call execution, but it never happens because attacker's sc starts recursive calls.
First question: did I get it correct?
Second question: why in all examples I see usage of call.value, but not transfer or send? Does it make any difference, if recursive calls will be done anyway? I see that you can adjust gas with call.value, but how does it affect the attack?
transfer and send were introduced to prevent reentrancies
Обсуждают сегодня