Currently it is possible to imperceptibly forge contract, i.e. add existing contract with codeHash other than that one specified in ABI
Context
We have two contracts:
- normal candle_ok.contract (src)
- malicious modified candle_mal.contract (src)
(both contract builds are attached to this issue)
Steps to reproduce:
- Upload & Instantiate malicious contract
- (better in other browser session) Click on
Add existing contract, upload ABI of normal contract, but specify the address of the malicious contract instance
Preferred behavior:
Compare the codeHash of contract at specified address with the one specified in ABI, and since it differs, return an error
Actual behavior:
UI shows everything is fine