Timeline for Why is noone exploiting the DAO contract?
Current License: CC BY-SA 4.0
14 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Aug 17, 2021 at 2:51 | history | edited | Yakitori | CC BY-SA 4.0 |
Old post was incorrect.
|
| Aug 15, 2021 at 22:31 | history | bounty ended | Ismael♦ | ||
| Aug 15, 2021 at 22:26 | comment | added | Ismael♦ | @Yakitori I think that is the correct answer. I suppose that due to the attack the contract has less ether than it is expecting and actualBalance calculation overflows. Great Job! | |
| Aug 14, 2021 at 1:00 | comment | added | Yakitori |
@ismael - After digging a bit, I think I found. The newDao contract gets fundsToBeMoved (line 986) which is computed using actualBalance() - which seems to underflow when called on Etherscan and is now equal a to a very big number. Thus, since there's not enough funds in the contract to be sent, the transaction throws. If the answer is ok for you, I'll update it. Anyway, thanks for the heads-up.
|
|
| Aug 13, 2021 at 21:53 | comment | added | Ismael♦ |
@Yakitori If I remember correctly the recursive attack wasn't on the rewards contract but the ethers being sent to the newDao created, since balances[msg.sender] isn't reset the attacker could move more funds than their share.
|
|
| Aug 13, 2021 at 19:35 | comment | added | Yakitori |
@Ismael I updated it, but it doesn't change anything really - the hacker would only be able to steal his own funds. payOut only sends funds from the rewardAccount, not the original contract.
|
|
| Aug 13, 2021 at 19:33 | history | edited | Yakitori | CC BY-SA 4.0 |
added 198 characters in body
|
| Aug 13, 2021 at 4:46 | comment | added | Ismael♦ |
Great work! I've some concerns though. The rewardAccount contract has a fallback function () { accumulatedInput += msg.value; } so an attacker could deposit ether before attacking so payOut won't fail. Don't worry about the rewards points, I'll extend the deadline if necessary, perhaps assign partial points for your research.
|
|
| Aug 10, 2021 at 14:33 | vote | accept | John1 | ||
| Aug 9, 2021 at 14:18 | comment | added | Yakitori | @John1, could you accept the answer then? | |
| Aug 9, 2021 at 7:03 | comment | added | John1 |
To confirm, it's not the original DAO contract at 0xbb9bc244d798123fde783fcc1c72d3bb8c189413 that can sends ether, rather the rewardAccount contract at 0xd2e16a20dd7b1ae54fb0312209784478d069c7b0 which has 0 ether now.
|
|
| Aug 9, 2021 at 2:11 | review | Late answers | |||
| Aug 9, 2021 at 5:31 | |||||
| Aug 9, 2021 at 1:56 | review | First posts | |||
| Aug 9, 2021 at 4:58 | |||||
| Aug 9, 2021 at 1:52 | history | answered | Yakitori | CC BY-SA 4.0 |