I noticed that multi-index (which is under eosio namespace) uses the following to prevent access to another contract's tables:

eosio_assert( _code == current_receiver(), "cannot create objects in table of another contract" );

But current_receiver is a global method defined in action.hpp.

So I wonder (because I don't have access to MacBook or Linux) would it be possible to create a smart contract that defines a function current_receiver() under eosio namespace and circumvent this security check to access another contract's tables?


You can see the apply_context.cpp, there's three main db operations: db_store_i64, db_update_i64, db_remove_i64, you can't update other tables even if you changed the multi_index definition.

  • There are checks to see the the action receiver is the same as the table code in update and remove but there are no checks in store. I was able to successfully store under another contract using my hack contract. This means that I could potentially harm other users by writing under their code. – pavybez Aug 14 '18 at 14:57
  • No, in the db_store_i64, only the receiver create the table, the receiver is not depend on you – Jimmy Guo Aug 15 '18 at 2:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.