I'm new in security of ICO and smart contracts. Trying to find bugs in verified contracts. I believe I found some problems in 0x42dB5Bfe8828f12F164586AF8A992B3a7B038164 but I dont know how to withdrawal. Do I need to create a transaction by myself?
HaHa - very sneaky.
To anyone tempted to mess with this contract - i.e. exploit the apparent flaw: you will likely lose your Ether.
It looks like there is a pretty tempting vulnerability in the
withdrawal() function: when you send the function more than
Limit Wei then it will send you the whole balance of the contract - the amount you sent plus the 0.36 Eth already there. Instant profit!
However, there is this innocent-looking, but nonetheless peculiar
delegatecall to a
logEvent() function in a different contract. To cut a long story short, this does not log an event. It actually sneakily modifies the value of the
adr storage variable so that it no longer points to
msg.sender. So the contract balance will not be sent back to you by the
adr.send(this.balance) call, it will be sent somewhere else, since
adr is no longer equal to
It's a bit obfuscated, but it looks like the delegated call to the
email.logEvent() contract function causes
adr to be set to the contract's own address: i.e. it sends all the Ether (including that which you sent) to itself. Only the contract owner (0x46Feeb381e90f7e30635B4F33CE3F6fA8EA6ed9b) can actually withdraw the Eth.