I'm new in security of ICO and smart contracts. Trying to find bugs in verified contracts. I believe I found some problems in 0x42dB5Bfe8828f12F164586AF8A992B3a7B038164 but I dont know how to withdrawal. Do I need to create a transaction by myself?
2
-
Hi there. It's not too clear what you're asking. Are you asking us how to drain the funds held by the contract...?– Richard HorrocksCommented Dec 29, 2017 at 13:53
-
How did you come across this and similar contracts?– willjgriffCommented Dec 31, 2017 at 9:58
Add a comment
|
1 Answer
HaHa - very sneaky.
***Warning***
To anyone tempted to mess with this contract - i.e. exploit the apparent flaw: you will likely lose your Ether.
Explanation follows.
It looks like there is a pretty tempting vulnerability in the withdrawal() function: when you send the function more than Limit Wei then it will send you the whole balance of the contract - the amount you sent plus the 0.36 Eth already there. Instant profit!
However, there is this innocent-looking, but nonetheless peculiar delegatecall to a logEvent() function in a different contract. To cut a long story short, this does not log an event. It actually sneakily modifies the value of the adr storage variable so that it no longer points to msg.sender. So the contract balance will not be sent back to you by the adr.send(this.balance) call, it will be sent somewhere else, since adr is no longer equal to msg.sender.
It's a bit obfuscated, but it looks like the delegated call to the email.logEvent() contract function causes adr to be set to the contract's own address: i.e. it sends all the Ether (including that which you sent) to itself. Only the contract owner (0x46Feeb381e90f7e30635B4F33CE3F6fA8EA6ed9b) can actually withdraw the Eth.
answered Dec 29, 2017 at 14:12
-
The first line in your answer implies that the dude who posted the question is trying to pull a scam. Did you really intend to imply this? Commented Dec 29, 2017 at 14:17
-
-
I'm not a scammer, I'm researching the contracts only. Thank you a lot for the awareness!– Mike N.Commented Dec 29, 2017 at 15:14
-
@Mike N. In that case, welcome and feel free to mark the answer accepted. Hopefully I've explained sufficiently why it's not a good idea to have anything to do with this contract if you don't own it. Commented Dec 29, 2017 at 16:07
-
2"Can we block them somehow?" - this is the blockchain. Despite the name, nothing can be blocked. It's a feature. If people lose Eth trying to hack the hackers, I'm not really that sympathetic. Commented Dec 29, 2017 at 16:30