I'm new in security of ICO and smart contracts. Trying to find bugs in verified contracts. I believe I found some problems in 0x42dB5Bfe8828f12F164586AF8A992B3a7B038164 but I dont know how to withdrawal. Do I need to create a transaction by myself?
Hi there. It's not too clear what you're asking. Are you asking us how to drain the funds held by the contract...?– Richard HorrocksDec 29, 2017 at 13:53
How did you come across this and similar contracts?– willjgriffDec 31, 2017 at 9:58
HaHa - very sneaky.
To anyone tempted to mess with this contract - i.e. exploit the apparent flaw: you will likely lose your Ether.
It looks like there is a pretty tempting vulnerability in the
withdrawal() function: when you send the function more than
Limit Wei then it will send you the whole balance of the contract - the amount you sent plus the 0.36 Eth already there. Instant profit!
However, there is this innocent-looking, but nonetheless peculiar
delegatecall to a
logEvent() function in a different contract. To cut a long story short, this does not log an event. It actually sneakily modifies the value of the
adr storage variable so that it no longer points to
msg.sender. So the contract balance will not be sent back to you by the
adr.send(this.balance) call, it will be sent somewhere else, since
adr is no longer equal to
It's a bit obfuscated, but it looks like the delegated call to the
email.logEvent() contract function causes
adr to be set to the contract's own address: i.e. it sends all the Ether (including that which you sent) to itself. Only the contract owner (0x46Feeb381e90f7e30635B4F33CE3F6fA8EA6ed9b) can actually withdraw the Eth.
The first line in your answer implies that the dude who posted the question is trying to pull a scam. Did you really intend to imply this? Dec 29, 2017 at 14:17
Ah, I see. Very good :-) +1 Dec 29, 2017 at 14:55
I'm not a scammer, I'm researching the contracts only. Thank you a lot for the awareness!– Mike N.Dec 29, 2017 at 15:14
@Mike N. In that case, welcome and feel free to mark the answer accepted. Hopefully I've explained sufficiently why it's not a good idea to have anything to do with this contract if you don't own it. Dec 29, 2017 at 16:07
2"Can we block them somehow?" - this is the blockchain. Despite the name, nothing can be blocked. It's a feature. If people lose Eth trying to hack the hackers, I'm not really that sympathetic. Dec 29, 2017 at 16:30