3.26 Reference Parameters

Remember that Solidity has value types and reference types. This security pitfall is related to the use of reference types in function parameters when structs, arrays or mappings, which are the reference types, are passed as arguments to a function.

They may be passed by value or they may be passed by reference. This difference is dictated by the use of either the memory or the storage keyword that specifies their data location. This was optional before Solidity version 0.5.0, but since that version it is required to be specified explicitly.

This difference is critical from a security perspective, because passing by value, if you remember, makes a copy, so any changes to the copy does not affect the original value. But passing by reference, creates a pointer to the original variable, so any changes to the passed value is actually modifying the original variable itself.

This, if not treated properly could lead to unexpected changes and modifications of the original variable or a copy which could have very different behavior and impact for the smart contract logic.