Smart Contract Security: 2. Bypassing EOA Check

Jul 25, 2023#Web3 #Blockchain #NFT #DeFi #DAO #DApp #区块链 #區塊鏈 #加密货币 #DeGame #链游 #Crypto #比特币 #以太坊 #Ethereum #合约开发350

AI Translation

This post is translated from Chinese into English through AI.View Original

AI-generated summary

The article discusses the concept of bypassing EOA (Externally Owned Account) checks in DeFi contracts. Many DeFi contracts only allow EOA addresses to perform critical operations, while contract addresses are not callable. This is achieved by checking the msg.sender. However, attackers can bypass this check by forging the msg.sender as an EOA address in their malicious contracts using methods like EOS or delegatecall. To prevent bypassing EOA checks, the article suggests the following methods: 1. Check both msg.sender and tx.origin to ensure the caller is an EOA. 2. Use a state variable to record the EOA on the first call and enforce its usage in subsequent calls. 3. Perform EOA checks in secure interface contracts, allowing users to only call through these interface contracts. 4. Utilize audited security libraries like OpenZeppelin's EOAChecker. The provided code examples demonstrate the implementation of these methods, including checking tx.origin, recording the EOA, and enforcing EOA checks in critical functions.

What is bypassing EOA check?

Many DeFi contracts only allow EOA to perform critical operations. Contract addresses cannot be invoked. This is achieved by checking msg.sender. However, attackers can bypass this check by forging msg.sender as an EOA address in their malicious contracts using EOS or delegatecall.

Methods to prevent bypassing EOA check:

Check not only msg.sender but also tx.origin to ensure that the caller is an EOA.
Use state variables to record EOA on the user's first call and enforce the use of recordedEOA for subsequent calls.
Perform EOA check in secure interface contracts, allowing users to only call through these interface contracts.
Use audited security libraries like OpenZeppelin's EOAChecker.

Code example:

// Also check tx.origin
require(msg.sender == tx.origin, "Not EOA");

// Record EOA on first call
address public userEOA; 

function initEOA() external {
  require(userEOA == address(0), "Already initialized");
  userEOA = msg.sender;
}

function criticalFunc() external {
  require(msg.sender == userEOA, "Only EOA can call");
  
  // Function logic
}