1

In this particular scheme, we pass the address of the Attacker contract in Victim.foo.

By using delegatecall, we maintain the msg.sender field, but we are not using the storage of Storage but Attacker's.

Is the Victim contract vulnerable to an attack where the msg.sender field is maintained (here it would be Victim's address) and using the storage of Victim too?

contract Victim {
  uint some;
  function foo(address _contract) {
    // ....
    SomeInterface(_contract).changeStorage(10);
    //....
  }
}

contract Storage {
  uint value;
  function changeStorage(uint _value) {
    require(msg.sender == victim);
    value = _value;
  }
}

contract Attacker {

  function changeStorage(uint _value) {
     bytes memory data = 0x.. //abi-encoded changeStorage with some value
     execute(victim, data);
  }

  function execute(address _target, bytes memory _data) {
    (bool success,) = _target.delegatecall(_data);
  }
}
2
  • "but we are not using the storage of B but Attacker's." - totally unclear IMO. You may want to start off by describing the entities in your system, and explaining the role of each one of the in the scenario that you are trying to present. While it's arguable that Attacker and Victim are self-explanatory, it is not arguable that B is totally not self-explanatory. – goodvibration Nov 26 '20 at 15:09
  • 1
    It doesn't matter what B is. You can name it however you want, the key is that only Victim can change its storage. I changed the name to make it easier. – Elisha Drion Nov 26 '20 at 15:35
0

This is what I'm understanding from the code and question: If A calls B, and B delegatecalls C, are state changes in the C execution affecting the storage in A?

The answer is no, it isn't. Since Victim is calling Attacker, Attacker's storage becomes the storage operated on and Victim is the msg.sender. Then when Attacker delegatcalls into Storage, it retains Victim as the msg.sender, as well as the storage operating on as Attacker.

The only way here to modify the storage in Victim is for Victim to delegatecall Storage directly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.