What are the worst cases if I allow my contract to call an evil action of an evil contract?

Question

I am considering to allow my contract to call the transfer action of a user specified contract. I would like to know what are the worst cases that can happen with this design.

My contract code will be something like:

void withdraw(/* .........*/)
{
    // ..........
    if (user_has_deposited_enough_tokens_of_that_user_specified_contract) {
        action(
            permission_level{ _self, N(active) },
            N(user_specified_contract), N(transfer),
            std::make_tuple(_self, user, quantity, "I am memo"))
        ).send();
    }
    // ..........
}

Since the transfer action of that user specified contract can be implemented in any way the author wanted (even with evil purpose), that means that author can take my "active" permission and do whatever he/she wants within the contract.

Will that author be able to transfer all my EOS away? (As far as I know, it can't transfer my EOS away because I didn't give my active permission to that user specified contract with "cleos set account permission", is that correct?)

Will that author be able to change my permission settings? (I think it can't change my permission settings because it doesn't have my owner permission, is that correct?)

What are the worst cases that can happen? (I guess nothing really bad can happen, is that correct?)

Answer 1

Signatures are not just a list which can be copied and pasted, they're a key which is generated from the transaction. if the transaction changes, the signature is invalidated and will need resigning.

Therefore, if you push a transaction to contract A, if A was a bad actor and wanted to steal your funds, a new transaction to eosio.token -> transfer would be required, that would require a new signature from yourself as the signature you provided in the transaction to A, was for that transaction and that transaction only.