4

I noticed that multi-index (which is under eosio namespace) uses the following to prevent access to another contract's tables:

eosio_assert( _code == current_receiver(), "cannot create objects in table of another contract" );

But current_receiver is a global method defined in action.hpp.

So I wonder (because I don't have access to MacBook or Linux) would it be possible to create a smart contract that defines a function current_receiver() under eosio namespace and circumvent this security check to access another contract's tables?

Improve this question

1 Answer 1

Reset to default
0

You can see the apply_context.cpp, there's three main db operations: db_store_i64, db_update_i64, db_remove_i64, you can't update other tables even if you changed the multi_index definition.

Improve this answer
2
  • There are checks to see the the action receiver is the same as the table code in update and remove but there are no checks in store. I was able to successfully store under another contract using my hack contract. This means that I could potentially harm other users by writing under their code.
    – pavybez
    Aug 14, 2018 at 14:57
  • No, in the db_store_i64, only the receiver create the table, the receiver is not depend on you
    – Jimmy Guo
    Aug 15, 2018 at 2:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.