Security – Can a Smart Contract Steal ETH?

contract-designinternal-transactionsSecuritytransactionswallet-transfer

I know that handing out your private key is like handing over your wallet and say "help yourself", but…

if I had register my public ETH address on some unknown smart contract (like sending a "transaction data" with MetaMask using 0 ETH), is it possible for the smart contract to withdraw/transfer ETH or any tokens from my wallet like a bank's debit order?

Best Answer

If you don't send any ether to a contract, it can't take any ether directly from you.

Tokens are another story. Those are just balances maintained in a smart contract. Most token transfers involve 0 ETH. Certainly sending a transaction to a token contract could result in those tokens being transferred, but even sending a transaction to a different contract could result in moved tokens. (A common case of this is ERC20 tokens' approve/transferFrom flow.)

Related Topic