01.SWC-100_Frunction Default Visibility

SWC-100_Frunction Default Visibility

Function Default Visibility

• Description: Functions that do not have a function visibility type specified are public by default. This can lead to a vulnerability if a developer forgot to set the visibility and a malicious user is able to make unauthorized or unintended state changes.

• Remediation: Functions can be specified as being external, public, internal or private. It is recommended to make a conscious decision on which visibility type is appropriate for a function. This can dramatically reduce the attack surface of a contract system.

vulnerable contract:

pragma solidity ^0.4.24;

contract HashForEther {

    function withdrawWinnings() { // fixed: add public
        // Winner if the last 8 hex characters of the address are 0. 
        require(uint32(msg.sender) == 0);
        _sendWinnings();
     }

     function _sendWinnings() { // fixed: add internal
         msg.sender.transfer(this.balance);
     }
}