2

I'm new in security of ICO and smart contracts. Trying to find bugs in verified contracts. I believe I found some problems in 0x42dB5Bfe8828f12F164586AF8A992B3a7B038164 but I dont know how to withdrawal. Do I need to create a transaction by myself?

  • Hi there. It's not too clear what you're asking. Are you asking us how to drain the funds held by the contract...? – Richard Horrocks Dec 29 '17 at 13:53
  • How did you come across this and similar contracts? – willjgriff Dec 31 '17 at 9:58
14

HaHa - very sneaky.

***Warning***

To anyone tempted to mess with this contract - i.e. exploit the apparent flaw: you will likely lose your Ether.

Explanation follows.

It looks like there is a pretty tempting vulnerability in the withdrawal() function: when you send the function more than Limit Wei then it will send you the whole balance of the contract - the amount you sent plus the 0.36 Eth already there. Instant profit!

However, there is this innocent-looking, but nonetheless peculiar delegatecall to a logEvent() function in a different contract. To cut a long story short, this does not log an event. It actually sneakily modifies the value of the adr storage variable so that it no longer points to msg.sender. So the contract balance will not be sent back to you by the adr.send(this.balance) call, it will be sent somewhere else, since adr is no longer equal to msg.sender.

It's a bit obfuscated, but it looks like the delegated call to the email.logEvent() contract function causes adr to be set to the contract's own address: i.e. it sends all the Ether (including that which you sent) to itself. Only the contract owner (0x46Feeb381e90f7e30635B4F33CE3F6fA8EA6ed9b) can actually withdraw the Eth.

  • The first line in your answer implies that the dude who posted the question is trying to pull a scam. Did you really intend to imply this? – goodvibration Dec 29 '17 at 14:17
  • Ah, I see. Very good :-) +1 – Richard Horrocks Dec 29 '17 at 14:55
  • I'm not a scammer, I'm researching the contracts only. Thank you a lot for the awareness! – Mike N. Dec 29 '17 at 15:14
  • @Mike N. In that case, welcome and feel free to mark the answer accepted. Hopefully I've explained sufficiently why it's not a good idea to have anything to do with this contract if you don't own it. – benjaminion Dec 29 '17 at 16:07
  • 2
    "Can we block them somehow?" - this is the blockchain. Despite the name, nothing can be blocked. It's a feature. If people lose Eth trying to hack the hackers, I'm not really that sympathetic. – benjaminion Dec 29 '17 at 16:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.