Solidity Bad Practices: Default Function Visibility

A function does not specify an explicit access modifier.

When developing a Solidity smart contract, developers can set the access modifier of a function to control who can invoke it. If a developer does not specify an access modifier, the function defaults to public, allowing a malicious actor to call the function without authorization.

Example 1: The following code fails to set the access modifier in both functions and therefore anyone can invoke them, allowing a user to bypass the call to require.

function withdrawWinnings() {
    require(uint32(msg.sender) == 0);
    _sendWinnings();
}

function _sendWinnings() {
    msg.sender.transfer(this.balance);
}