Merge pull request #2696 from AdrianClv/patch-1

Removes reference to stack depth attack
This commit is contained in:
chriseth 2017-08-04 14:21:04 +02:00 committed by GitHub
commit e48730fed9

View File

@ -277,9 +277,9 @@ activate themselves.
if (highestBidder != 0) {
// Sending back the money by simply using
// highestBidder.send(highestBid) is a security risk
// because it can be prevented by the caller by e.g.
// raising the call stack to 1023. It is always safer
// to let the recipients withdraw their money themselves.
// because it could execute an untrusted contract.
// It is always safer to let the recipients
// withdraw their money themselves.
pendingReturns[highestBidder] += highestBid;
}
highestBidder = msg.sender;