How does one prevent smart contracts from taking all your tokens, when you give them your auth?

Question

Suppose you are a malicious smart contract developer and embedded an inline transaction in your smart contract that calls eosio.token::transfer 100 eos from the caller's account to your account.

An unsuspecting user calls your contract's makepokemon action, and it calls an inline action that tries to take that 100 tokens. It didn't work, because cleos says that it's "missing required auth". That's because the makepokemon action requires auth of the user that's trying to make the pokemon.

So the user pushes the action with -p user@active, and now the contract can "steal" those tokens unrightfully? Or am I missing something?

disclaimer: I'm new to EOS and have only been messing around with tutorials and a local testnet, I might be oblivious to other things

Answer 1

When a contract sends an inline action, it cannot send with the permission level passed by the caller; it sends with a special eosio.code permission name.

In your example, makepokemon can only use [email protected] and not user@active, so user has to explictily give makepokemon permission to transfer tokens if they want to.

Answer 2

So the user pushes the action with -p user@active, and now the contract can "steal" those tokens unrightfully? Or am I missing something?

No, that can not steal the tokens because you check the authenticity inside the action itself. Then, it does not matter what permission are you sending via command line. Your makepokemon action should check the authenticity of both the accounts (sender and receiver) inside the action.

Check this line of code require_auth(account_name);

It is good to put as many asserts as you can in your contract actions as that is ultimate function which has to run in blockchain. So, make sure you cover all the cases before deploying it on blockchain.

HTH

Answer 3

Well, you can go to the contract's source code and check if it will or will not spend more funds than you want it to spend.