Browse Source

fix for short address attack

as suggested by /u/izqui9 here https://www.reddit.com/r/ethereum/comments/63s917/worrysome_bug_exploit_with_erc20_token/dfwmhc3/
Attack description: 
https://blog.golemproject.net/how-to-find-10m-by-just-reading-blockchain-6ae9d39fcd95
Jerome de Tychey 8 years ago
parent
commit
d9b9ed227b
1 changed files with 9 additions and 1 deletions
  1. 9 1
      contracts/token/BasicToken.sol

+ 9 - 1
contracts/token/BasicToken.sol

@@ -13,7 +13,15 @@ contract BasicToken is ERC20Basic, SafeMath {
 
   mapping(address => uint) balances;
 
-  function transfer(address _to, uint _value) {
+/*
+ * Fix for the ERC20 short address attack  
+ */
+  modifier onlyPayloadSize(uint size) {
+     assert(msg.data.length == size + 4);
+     _;
+  }
+
+  function transfer(address _to, uint _value) onlyPayloadSize(2 * 32) {
     balances[msg.sender] = safeSub(balances[msg.sender], _value);
     balances[_to] = safeAdd(balances[_to], _value);
     Transfer(msg.sender, _to, _value);