- What does "require_recipient" function actually do? What's the difference between require_recipient and inline action?
- If contract A calls contract B using require_recipient, can contract B use require_recipient again and call contract C? If not, why?
Actually, I am coding my "notify" function which will listen to eosio.token then take actions when somebody transfer eos to my contract, and wondering if the answer to question 2 is yes, is an attacker have chance that call my "notify" function more than once in a single transaction.
As you can see the code of transfer function in eosio.token(code here), the transfer function will call both sender's and receiver's "notify" function, so, what will happen if sender calls receiver's "notify" in its "notify" function using require_recipient? Will receiver's "notify" function called twice?
I tested it and it turns out that the transaction was succeed but receiver's "notify" function only ran once, but I don't know if EOS has any mechanism to prevent that, or just some error in my test code.
In other words, I am asking if this situation could happen:
1. attacker calls eosio.token and transfer to victim.
2. eosio.token calls attacker's "notify" function.
3. attacker's "notify" function uses require_recipient and calls victim's "notify" function, victim's "notify" function executed for the first time.
4. eosio.token calls victim's "notify" function, so victim's "notify" function executed for the second time.
Since the transfer is real happened and require_recipient do not change the data, victim's "notify" function will called twice with code == "eosio.token", action == "transfer" and to == _self. It seems that it it impossible to distinguish these two calls by action data. But in my test victim's "notify" function only called once, so does eos have any mechanism to prevent that?