@liwi 19 January 2022 more from that month

之前討論到重入攻擊 re-entrancy attack https://noise.cash/post/l34wjvjz 然後這篇關於英式競標智能合約的文章 [1] 以 The DAO 為鑑提了一個 rule of thumb 是不要主動退還標金 應該要讓用戶去觸發退款的請求 所以比如說在這個英式競標智能合約範例裡 https://solidity-by-example.org/app/english-auction/ 就四個函式：開始拍賣、出價、取消出價、結束拍賣。 印象中 Bonfida 上的 Solana Naming Service 也是這樣的簡單流程 （雖然不是 EVM？但安全性概念大概是放諸公鏈皆通的） 出價被超過後使用者要先取消出價然後重新出價 得標後使用者要做 claim 的動作估計就是在執行結束拍賣函式 沒得標也要自己取消才能拿回資金 那 Oasis 出價被超過後則是會主動退回標金 就好奇會不會有漏洞可以鑽 有沒有噪咖要寫合約去試著出價看看 XD 我是猜啦，因為每次出現更高標價時前一標已經被退掉了， 所以就算用合約出價然後寫了惡意的 fallback 程序， 合約裡也會判斷沒有多餘的錢可以再退了，所以不會溢退。 另一個可能是 如果 fallback 沒有設 gas limit [2] fallback 可能會把 gas 吃光造成交易失敗 也就是說出價不會被取消 可能就可以因此出個一口價得標 這個可能倒是可以寫合約去戳看看 Oasis 敲碗勇者報告了~ 之前也討論到哄抬拍賣價格的可能 這也可能用合約來做甚至還可以做到不被直接察覺 （比如說寫合約讓合約開新合約去競標） 而能做到什麼程度取決的瓦斯費跟 NFT 的可剝削價值 總之每多了解一點就又覺得 NFT 市場更險惡了一些 所以還是買喜歡的好玩的最重要 [1] https://medium.com/@bryn.bellomy/solidity-tutorial-building-a-simple-auction-contract-fcc918b0878a We know from the DAO hack that it’s always best to stick to a “withdrawal” pattern — this helps us to avoid re-entrance bugs that could cause unexpected behavior (including catastrophic financial loss for our users). We should only send ETH to a user when they explicitly request it, and we should try to avoid doing much of anything else in that function. For example, what would happen if a user sent a bid from a contract with a maliciously-crafted fallback function designed to expend all of the gas provided to it? That user could never be outbid, because when someone else tried to place a bid, the EVM would send ETH back to that malicious fallback function. The transaction would run out of gas, preventing the new user’s bid from being recorded. [2] https://ethereum.stackexchange.com/questions/5992/how-much-computation-can-be-done-in-a-fallback-function