Zcoin implementation bug enabled attacker to create over 500K Zcoins

Re:Zcoin implementation bug enabled attacker to create over ... by aethertap on Tuesday March 07, 2017 @10:16AM (#13810908)

Actually the type system catches that particular mistake:

    error[E0308]: mismatched types
     --> src/main.rs:5:6
      |
    5 |   if x = 1 {
      |      ^^^^^ expected bool, found ()  
      |
      = note: expected type `bool`
      = note:    found type `()`
    
    error: aborting due to previous error
    
    error: Could not compile `playground`.
    
    To learn more, run the command again with --verbose.

[ Parent | on HN ]

Re:Zcoin implementation bug enabled attacker to create over ... by tyingq on Tuesday March 07, 2017 @10:29AM (#13811036)

Interesting. Is there any plausible way that Rust can fall into the == vs = trap?

[ Parent | on HN ]

Re:Zcoin implementation bug enabled attacker to create over ... by steveklabnik on Tuesday March 07, 2017 @11:52AM (#13811960)

No, as assignment always results in (), and if always requires a boolean. This is by design.

[ Parent | on HN ]

Re:Zcoin implementation bug enabled attacker to create over ... by tyingq on Tuesday March 07, 2017 @12:27PM (#13812423)

Ah...so this works:

  fn main() {
      let mut x = false;
      println!("{}", x);
      if {x=true;x} {
          println!("{}", x);
      }
  }

But stands out as pretty obvious. Not something you might easily sneak into a codebase.

[ Parent | on HN ]

Re:Zcoin implementation bug enabled attacker to create over ... by steveklabnik on Tuesday March 07, 2017 @12:51PM (#13812736)

Sneaky! Yeah, no way this should get past code review, and not even easy to accidentally type.

[ Parent | on HN ]

Re:Zcoin implementation bug enabled attacker to create over ... by aethertap on Tuesday March 07, 2017 @10:53AM (#13811308)

I haven't yet reached the level of Rust mastery where I'm confident in this answer, but as far as I can tell it's very hard to make that kind of mistake. I'd be very interested to hear what others have to say on it though.

[ Parent | on HN ]