Skip to content

Commit f901f50

Browse files
authored
Remove comments on cross-contract reentrancy venerability (#308)
## Type of change <!--Delete points that do not apply--> - Documentation ## Changes The following changes have been made: - Removed cautionary note on cross-contract vulnerability in inline docs - Removed comment on cross-contract vulnerability in documentation - Added note stating cross-contract reentrancy not possible but to still exercise caution ## Notes - Cross-contract reentrancy occurs when a contract like a vault issues and manages assets for token contract. However, as Fuel uses native assets, no contract call must be made to update balances. Therefore it is not possible to perform a cross-contract reentrancy attack. - A cautionary note on relying on other contracts for state has been added as this can introduce dependency attacks. ## Related Issues <!--Delete everything after the "#" symbol and replace it with a number. No spaces between hash and number--> Closes #307 ## Checklist - [x] I have linked to any relevant issues. - [x] I have commented my code, particularly in hard-to-understand areas. - [x] I have updated the documentation where relevant (API docs, the reference, and the Sway book). - [x] If my change requires substantial documentation changes, I have [requested support from the DevRel team](https://github.com/FuelLabs/devrel-requests/issues/new/choose) - [x] I have added tests that prove my fix is effective or that my feature works. - [x] I have added (or requested a maintainer to add) the necessary `Breaking*` or `New Feature` labels where relevant. - [x] I have done my best to ensure that my PR adheres to [the Fuel Labs Code Review Standards](https://github.com/FuelLabs/rfcs/blob/master/text/code-standards/external-contributors.md). - [x] I have requested a review from the relevant team or maintainers. - [x] I have updated the changelog to reflect the changes on this PR.
1 parent 03f8ff9 commit f901f50

File tree

3 files changed

+6
-8
lines changed

3 files changed

+6
-8
lines changed

CHANGELOG.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ Description of the upcoming release here.
1818

1919
- [#305](https://github.com/FuelLabs/sway-libs/pull/305) Updates to forc `v0.66.2`, fuel-core `v0.40.0`, and fuels-rs `v0.66.9`.
2020
- [#306](https://github.com/FuelLabs/sway-libs/pull/306) Updates the SRC-7 naming to Onchain Native Asset Metadata Standard.
21+
- [#308](https://github.com/FuelLabs/sway-libs/pull/308) Removes comments on Cross-Contract Reentrancy vulnerability.
2122

2223
### Fixed
2324

docs/book/src/reentrancy/index.md

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,17 +2,12 @@
22

33
The Reentrancy Guard Library provides an API to check for and disallow reentrancy on a contract. A reentrancy attack happens when a function is externally invoked during its execution, allowing it to be run multiple times in a single transaction.
44

5-
The reentrancy check is used to check if a contract ID has been called more than
6-
once in the current call stack.
5+
The reentrancy check is used to check if a contract ID has been called more than once in the current call stack.
76

87
A reentrancy, or "recursive call" attack can cause some functions to behave in unexpected ways. This can be prevented by asserting a contract has not yet been called in the current transaction. An example can be found [here](https://swcregistry.io/docs/SWC-107).
98

109
For implementation details on the Reentrancy Guard Library please see the [Sway Libs Docs](https://fuellabs.github.io/sway-libs/master/sway_libs/reentrancy/index.html).
1110

12-
## Known Issues
13-
14-
While this can protect against both single-function reentrancy and cross-function reentrancy attacks, it WILL NOT PREVENT a cross-contract reentrancy attack.
15-
1611
## Importing the Reentrancy Guard Library
1712

1813
In order to use the Reentrancy Guard library, Sway Libs must be added to the `Forc.toml` file and then imported into your Sway project. To add Sway Libs as a dependency to the `Forc.toml` file in your project please see the [Getting Started](../getting_started/index.md).
@@ -45,3 +40,7 @@ To check if the current caller is a reentrant, you may call the `is_reentrant()`
4540
```sway
4641
{{#include ../../../../examples/reentrancy/src/main.sw:is_reentrant}}
4742
```
43+
44+
## Cross Contract Reentrancy
45+
46+
Cross-Contract Reentrancy is not possible on Fuel due to the use of Native Assets. As such, no contract calls are performed when assets are transferred. However standard security practices when relying on other contracts for state should still be applied, especially when making external calls.

libs/src/reentrancy.sw

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,6 @@ use std::registers::frame_ptr;
1515
///
1616
/// Not needed if the Checks-Effects-Interactions (CEI) pattern is followed (as prompted by the
1717
/// compiler).
18-
/// > Caution: While this can protect against both single-function reentrancy and cross-function
19-
/// reentrancy attacks, it WILL NOT PREVENT a cross-contract reentrancy attack.
2018
///
2119
/// # Examples
2220
///

0 commit comments

Comments
 (0)