Remove isContract due to potential misuse
See original GitHub issueIn spite of the warnings provided in the comments of the function itself, the name isContract
is a misnomer and creates a potential security risk for anyone who doesn’t bother to read the notes or someone who is reviewing a 3rd party contract that uses this fn.
There is a misconception that calling this function will return false if the address is an eoa. This can lead to the inadvertant introduction of an exploit and other risks already clearly identified in the comments. But comments inside the function are not enough in this case where the name of the fn is so blatantly misleading.
Propose changing the name of the function to hasCode
which is much more descriptive of what the function does. This should be a breaking change and may end up being a wake up call to anyone who has been misusing the fn to date.
Issue Analytics
- State:
- Created a year ago
- Reactions:9
- Comments:12 (6 by maintainers)
@Amxx I would propose manually inlining the logic, but instead of assembly we use
address(..).code.size
assertIsContract
would be safe, but I’m not sure what it would be useful for.isContract
is necessary to implement standards like ERC721 and ERC1155.Nowadays Solidity has
addr.code.lengh
that we could use directly. WhenAddress.isContract
was introduced this feature didn’t exist andisContract
was used to wrap the necessary assembly.Note that removal of
isContract
would be a breaking change, so the best we can do now is to deprecate it and mark it for removal in 5.0. I would be in favor of this.