From 3c6cdf882151317f181c1789738a600a40ca41cf Mon Sep 17 00:00:00 2001 From: "Daniel A. Nagy" Date: Mon, 29 Aug 2016 15:52:15 +0200 Subject: [PATCH] swarm: Fixes reentrancy bug allowing a malicious beneficiary to withdraw more funds than in the cheque through a recursive callback of cash() from the default function of the contract at the beneficiary address. --- swarm/services/chequebook/contract/chequebook.sol | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/swarm/services/chequebook/contract/chequebook.sol b/swarm/services/chequebook/contract/chequebook.sol index cb19d0b27b..eefe6c0637 100644 --- a/swarm/services/chequebook/contract/chequebook.sol +++ b/swarm/services/chequebook/contract/chequebook.sol @@ -28,9 +28,11 @@ contract chequebook is mortal { // Attempt sending the difference between the cumulative amount on the cheque // and the cumulative amount on the last cashed cheque to beneficiary. if (amount - sent[beneficiary] >= this.balance) { - if (beneficiary.send(amount - sent[beneficiary])) { - // Upon success, update the cumulative amount. - sent[beneficiary] = amount; + // update the cumulative amount before sending + sent[beneficiary] = amount; + if (!beneficiary.send(amount - sent[beneficiary])) { + // Upon failure to execute send, revert everything + throw; } } else { // Upon failure, punish owner for writing a bounced cheque.