Lets say I interact with an action from a smart contract, if I'm not careful and didn't read or couldn't understand the source code for the smart contract, is it not possible that the contract could purposefully fill a database entry with junk data and charge me the RAM for it?

If that happens, is there a mechanism to delete the table entry for the end-user? I don't think that that should be possible, so if this happened you would be at the mercy of the smart-contract owner, who may not delete the entry if they are being malicious.

Is this understanding correct?

  • 1
    no mechanism, you're right, take care don't buy too much ram in your account, however, malicious contract can not take your ram away – Jimmy Guo Aug 10 at 9:00
  • 1
    Ok, so lets say I have created a multi-index table. You have to pay for RAM storage. You create an entry by doing an action from my contract. However, I have nothing in my contract to delete orders. Are you saying that the solution would be to create your own contract, set up an equivalent multi-index, and delete it from there? I thought that the database entries belonged to the account that created them (in this case the original contract). – Phillip Hamnett - EOS42 Aug 10 at 10:29
  • 1
    yeah, that's what i imagined. haven't tried to initialise a table with a different code, so i need to try that, but this may be doable at the very least with the right permissions, which can be a prerequisite to interact with the contract. i may give it a try this weekend – confused00 Aug 10 at 10:55
  • 1
    It wouldn't make sense to allow users to delete data from other smart contracts. This would break a huge amount of functionality and they'd be quite useless. Seems like a malicious contract can gobble your RAM if you aren't careful :-/ – Alex Aug 10 at 22:36
  • 1
    yeah Todd Fleming confirmed that OP is correct and there's no mechanism against this – confused00 Aug 17 at 1:09
up vote 4 down vote accepted

Yes, I believe that your understanding is correct, as confirmed in a discussion on Telegram Developers Channel pasted below--Todd Fleming is a contributor to EOSIO codebase:

16th of August

User: is there any way for an user to remove RAM allocated that they own ? let’s say that I own a malicious contract that once an action hit, check ram of user, and fullfill it with [useless] data, and I dont provide a remove method

Todd Fleming: The contract is the only thing that can free the ram

User: and you cannot do anything if contract consume so much ram of user account ?

Todd Fleming: Right. Be careful what contracts you send actions to.

  • if someone can provide a better answer than an informal Telegram discussion please do share, but at the moment this question has gone unanswered for 10 days so maybe this is marginally better than nothing – confused00 2 days ago

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.