IsContract Function Usage

[code423n4]

Handle

defsec

Vulnerability details

Impact

the isContract function that uses EXTCODESIZE was discovered to be hackable. The function will return false if it is invoked from a contract's constructor (because the contract has not been deployed yet).

The code should be used very carefully, if at all, to avoid security hacks such as:

https://www.reddit.com/r/ethereum/comments/916xni/how_to_pwn_fomo3d_a_beginners_guide (archive)

Proof of Concept

Navigate to "https://github.com/code-423n4/2021-12-mellow/blob/6679e2dd118b33481ee81ad013ece4ea723327b5/mellow-vaults/contracts/Vault.sol#L204"
The function is allowed with isContract modifier.
However this is vulnerable implementation.
The sample code can be seen below.

Tools Used

None

Recommended Mitigation Steps

If you want to make sure that an EOA is calling your contract, a simple way is require(msg.sender == tx.origin). However, preventing a contract is an anti-pattern with security and interoperability considerations. (ethereum/solidity#683 - https://ethereum.stackexchange.com/questions/1891/whats-the-difference-between-msg-sender-and-tx-origin)

[MihanixA]

Duplicates #126 IMO

[0xleastwood]

this does look like a duplicate. Marking as invalid.