1

I have seen that some contract need eosio.code permission to deploy contract. So, i have few questions regarding eosio.code that are as below

  1. What is eosio.code permission?
  2. Do we need to add code in contract about this permission ? if yes then please state code example to have this permission in contract.
  3. Is there any compromisation with security by adding this permission ?
4

The permission eosio.code, gives permission for the contract to use inline actions.

You don't need to add anything specific to the source code in order for the permissions on the contract to be valid, but rather you need to make sure you have valid permissions given certain code. For example, you need eosio.code permission in order to do EOS transfers within your contract.

There is a compromise in security every time you add a permission to an account or smart contract. An incorrectly formed contract with this permission could potentially allow someone to transfer funds that they shouldn't transfer.

5
  • So, whenever an account give permission to contract an account holder must trust on contract right ?
    – Mr.Y
    Feb 1 '19 at 12:02
  • Exactly. Not very advisable... Feb 1 '19 at 12:03
  • Is there any way that an account holder can see permissions given by them to one or more contracts ? and are they able to remove this permission ?
    – Mr.Y
    Feb 1 '19 at 12:06
  • I don't think this is true actually, there is no check for inclusion of .code as string (otherwise, eosio.token.code would't work, as its too long). nodeos does however have a hard-coded value of eosio.code as a reference to a contract's implicit authorization.
    – abourget
    Dec 17 '20 at 5:46
  • @abourget You are correct, I wrote this answer a long time ago and will correct it now Dec 17 '20 at 6:20
1

eosio.code permission on your account will give access to target account from contract-code, which eosio.code permission you use.

For example, if account Bob will set contractA@eosio.code on their active permission slot, contractA will get active permissions from the code to Bob's account.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.