潜在的重新进入漏洞:我应该如何重新排列这个函数以避免它？

Question

我不确定为什么我总是得到一个关于"publishEtherBox“函数的潜在重入攻击漏洞。合同代码不完整，但应该足够理解。这是一个糟糕的语法问题，还是其他问题？

contract {
...
  struct EtherBox {
    bytes32 label;
    address owner;
    string ownerUrl;
    uint256 expiration;
  }

  mapping (address => bytes32) public nicknames;
  mapping (address => address[]) public ownerToEtherBoxes;
  mapping (address => EtherBox) public etherBoxes;
  mapping (address => uint256) etherBoxesNonce;
...
  function publishEtherBox (bytes32 _label, string _ownerUrl, uint _lifespan) external onlyWhenRunning() payable {
      require(ownerToEtherBoxes[msg.sender].length < 10);
      assert(bytes(_ownerUrl).length <= 200);
      address etherBoxAddress = address(keccak256(msg.sender, etherBoxesNonce[msg.sender]++));
      ownerToEtherBoxes[msg.sender].push(etherBoxAddress);
      etherBoxes[etherBoxAddress] = EtherBox({
        label: _label,
        owner: msg.sender,
        ownerUrl: _ownerUrl,
        expiration: now + _lifespan
      });
      if(msg.value > 0){
        owner.transfer(msg.value);
      }
      emit EtherBoxPublished(msg.sender, nicknames[msg.sender], etherBoxAddress, _label, now);
  }
...
}

Answer 1

这里没有真正的问题，但是如果您想要沉默编译器警告，可以让.transfer()调用函数中的最后一件事：

function publishEtherBox(...) ... {
    ...
    emit EtherBoxPublished(msg.sender, nicknames[msg.sender], etherBoxAddress, _label, now);
    if (msg.value > 0) {
        owner.transfer(msg.value);
    }
}