0

I am working on Truffle console using commands like:(i.e. web3.js, if I am not wrong)

module.exports = async function(callback) {
try {
    // Fetch accounts from wallet - these are unlocked
    const accounts = await web3.eth.getAccounts()
    // Set up account to transferEther to Victim
    const acc3 = accounts[3]
    acc3bal = await web3.eth.getBalance(acc3)
    web3.utils.fromWei(acc3bal, "ether")
    // Fetch the deployed exchange
    const fb = await Attack.new()//Right now I know the name of contract
    
    :
    :
}
  }
}
  catch(error) {
    console.log(error)
  }
  callback()
}

How can I check the presence of some opcode like: selfdestruct and how can I retrieve contract's name so that I can create contract's object?

Example contract code is given below:

contract Attack {     
   EtherGame etherGame;      
   constructor(EtherGame _etherGame) {         
      etherGame = EtherGame(_etherGame);     
   }      
   function attack() public payable {         
      // You can simply break the game by sending ether so that 
      // the game balance >= 7 ether 
      // cast address to payable 
      address payable addr = payable(address(etherGame));              
      selfdestruct(addr);
   } }

Zulfi.

1 Answer 1

1

FURTHER_EDITS: Here's the code to validate selfdestruct's existence in the contract.

// substite your path here
const contractPath = path.resolve(__dirname, "contracts", "Attack.sol"); 
const contractCode = fs.readFileSync(contractPath, "utf8");
// >=0 is true // -1 is false
const selfdestructExists = (contractCode.search("selfdestruct") >= 0 ? true : false);
console.log('selfdestruct exists:', selfdestructExists); 
// if true then initiate the test...

=========================================

EDITS after additional clarity from zak100: "I have shown a smart contract (SC) named Attack, it is stored in a fie say, attack.sol, how can I use web3.js to check if the SC contains selfdestruct opcode or not?".

NEW INPUT: If your intent is to instantiate a contract's object only if it contains selfdestruct then you could very well leverage JavaScript packages path & fs (a) to load all contract files available and (b) by then checking for the occurrence of the string 'selfdestruct' within each file's content. (c) If occurrence found then create that object - this one needs to be explored a bit further.

All in all, my point is to not be dependent on web3 alone and leverage path and fs for your requirement.

const path = require("path");
const fs = require("fs");

Hope this helps. Again, please clarify further in case I have missed the ask.


Immediate answer: Get bytecode. Get opcode from bytecode. Search for 'SelfDestruct' in the opcodes.

  1. For bytecode

    await web3.eth.getCode(etherStore.address);

NOTE: Ensure that you are clear between the deployment bytecode and runtime bytecode. Refer this thread on ESE for clarity.

  1. For opcode: Use Etherscan based functionality here.

**Now, what's the requirement?
I see that you are trying out the selfdestruct hack in solidity-by-example to throw a contract's balance off-balance.

If that's the case, your attacking contract is the one that will have selfdestruct. The victim/target contract's address should simply suffice as that's the value you will pass to the selfdestruct call to your attacking contract.

Your attacking contract will need a certain amount of ETH to feed the victim contract. Note that in this hack, you are actually giving ETH to the victim contract. Intent is to mess the contract's balance such that any balance dependent code in that victim contract goes for a toss.

For the above intent, you simply need the victim contract's address. That itself should suffice.

Hope this helps. If not, please clarify your ask.

9
  • Sorry, you can't understand. I have shown a smart contract (SC) named Attack, it is stored in a fie say, attack.sol, how can I use web3.js to check if the SC contains selfdestruct opcode or not?
    – zak100
    Jan 1, 2022 at 4:35
  • 1
    @zak100, I have updated my prior answer with additional inputs based on your clarification. I am still missing the goal here - sorry - what's the endgame? Jan 1, 2022 at 13:24
  • 1
    Noted @zak100 / Zulfi. If testing's the intent then the Attacker contract becomes your test-bed, your driver. Victim contract addresses become the input for your Attacker contract - the addresses would suffice as those would be the input you would pass to your Attacker's attack method, the eventual parameter to your selfdestruct. I will leave it at that. Good luck! Jan 2, 2022 at 4:46
  • 1
    If Attacker is your driver then you already know that your Attacker has selfdestruct. In fact that's THE requirement. Attacker's selfdestruct feeds victims to mess up their balance. Attacker being your driver, you already know that it has selfdestruct. Unless your requirement is different ie. you are searching for contracts with selfdestruct that you would want to invoke with your address. In that case the Attacker contracts become the attacked (victims) :-) Anyway, code updated in the comment. Again, good luck! Jan 2, 2022 at 5:42
  • 1
    @zak100: I have provided the code snippet on my original comment as an update. Use that along with the const path and fs declarations. Hope this helps. Jan 2, 2022 at 5:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.