Merge pull request #2696 from AdrianClv/patch-1

Removes reference to stack depth attack
This commit is contained in:
chriseth 2017-08-04 14:21:04 +02:00 committed by GitHub
commit e48730fed9

View File

@ -277,9 +277,9 @@ activate themselves.
if (highestBidder != 0) { if (highestBidder != 0) {
// Sending back the money by simply using // Sending back the money by simply using
// highestBidder.send(highestBid) is a security risk // highestBidder.send(highestBid) is a security risk
// because it can be prevented by the caller by e.g. // because it could execute an untrusted contract.
// raising the call stack to 1023. It is always safer // It is always safer to let the recipients
// to let the recipients withdraw their money themselves. // withdraw their money themselves.
pendingReturns[highestBidder] += highestBid; pendingReturns[highestBidder] += highestBid;
} }
highestBidder = msg.sender; highestBidder = msg.sender;