CORIONplatform / solidity

GNU General Public License v3.0
12 stars 9 forks source link

module: _replaceModule uses send() method to transfer balance #100

Closed gundas closed 7 years ago

gundas commented 7 years ago

If any of the future modules decide to implement a fallback function, the balance transfer to those modules might fail - send executes the fallback function on the destination contract, but the gas is limited to 2300: https://github.com/CORIONplatform/solidity/blob/master/module.sol#L99

As explained in http://www.blunderingcode.com/writing-secure-solidity/, a possible solution could be using:

 require( newModuleAddress.call.value(this.balance)() );
iFA88 commented 7 years ago

I think the gas is not limited to 2300. Where you got that? send or call would do the same OP code.

Dexaran commented 7 years ago

This is critical: https://github.com/CORIONplatform/solidity/blob/master/module.sol#L98-L100

If there will be no function() payable { } in any future module then the replacement will fail!

Each module must have fallback function implementation by default.

Dexaran commented 7 years ago

@iFA88 .send provides 2300 gas. It's true.

The similar example is described here: http://solidity.readthedocs.io/en/develop/common-patterns.html

iFA88 commented 7 years ago

https://github.com/CORIONplatform/solidity/pull/106