Hacker News new | ask | show | jobs
by mpeg 3121 days ago
Since setGoalFailed is public (because you want it to be callable by the person trying to achieve the goal, and the contract owner is the supervisor) and does no checks, seems like anyone can mark a goal as failed and the money held in the smart contract will go to the contract owner?

Shouldn't that check that msg.sender is either goals[_hash].owner or owner ?
2 comments
superkarolis 3121 days ago
You are right, thank you for spotting this! I will have to make a new contract, this one is flawed. If someone decides to call this function and I get the funds, I will give a manual refund. It will have to do until v2 release of the contract. Right now at least it's not holding any major funds.
link
mpeg 3121 days ago
No worries! Still much better code than Parity Multisig and their fake constructors :)
link
heptathorp 3121 days ago
It also doesn't appear to be checking if a goal has already been set as failed, so someone could fail their goal repeatedly and drain the contract of all its funds.
link