当前位置:网站首页>On the pit of delegatecall of solidity
On the pit of delegatecall of solidity
2022-06-22 06:32:00 【youngqqcn】
There is a problem today , Record this pit
pragma solidity ^0.4.26;
contract Proxy {
address internal masterCopy;
constructor(address _masterCopy)
public
{
require(_masterCopy != address(0), "Invalid master copy address provided");
masterCopy = _masterCopy;
}
/// @dev Fallback function forwards all transactions and returns all received return data.
function ()
external
payable
{
// solium-disable-next-line security/no-inline-assembly
assembly {
let masterCopy := and(sload(0), 0xffffffffffffffffffffffffffffffffffffffff)
// 0xa619486e == keccak("masterCopy()"). The value is right padded to 32-bytes with 0s
if eq(calldataload(0), 0xa619486e00000000000000000000000000000000000000000000000000000000) {
mstore(0, masterCopy)
return(0, 0x20)
}
calldatacopy(0, 0, calldatasize())
let success := delegatecall(gas, masterCopy, 0, calldatasize(), 0, 0)
returndatacopy(0, 0, returndatasize())
if eq(success, 0) { revert(0, returndatasize()) }
return(0, returndatasize())
}
}
}
contract Erc20 {
address public sender;
event DoSomething(address);
function dosomthing() public returns(bool){
sender = msg.sender;
emit DoSomething(msg.sender);
return true;
}
}
contract Hacker {
event Ok(address,bytes,uint256);
event Failed(bool);
function setErc20Addr(address addr) public returns(bool) {
erc20 = Erc20(addr);
}
Erc20 public erc20 ;
function exec(address addr, bytes data, uint256 amount) public payable returns(bool){
bool success = erc20.dosomthing();
if(success) {
emit Ok(addr, data, amount);
return true;
} else {
emit Failed(false);
return false;
}
}
}
call setErc20Addr after , Call directly Hacker The successful , But by calling proxy Of fallback Functions always fail .
remix The errors reported in the report are as follows 
What is the reason ?
as a result of delegatecall The mechanism of : https://solidity-cn.readthedocs.io/zh/develop/introduction-to-smart-contracts.html?highlight=delegatecall#index-13

in other words , bool success = erc20.dosomthing(); This sentence ,erc20 yes Hacker Members of , When in Proxy Of fallback Call up Hacker Of exec when , Just put exec Function code is used to , Not yet Hacker Of erc20 Copy the past together , therefore ,erc20 It's empty. !
After the modification :
contract Hacker {
event Ok(address,bytes,uint256);
event Failed(bool);
function exec(address addr, bytes data, uint256 amount) public payable returns(bool){
Erc20 erc20 = Erc20(addr);
bool success = erc20.dosomthing();
if(success) {
emit Ok(addr, data, amount);
return true;
} else {
emit Failed(false);
return false;
}
}
}
in other words ,erc20 Contract address by Proxy Of fallback Pass in when calling , Reinitialize erc20. Now you can call it normally .
边栏推荐
猜你喜欢
随机推荐
Upload file prompt 413 request entity too large error
什么是JUC
关于solidity的delegatecall的坑
深度解析Optimism被盗2000万个OP事件(含代码)
The song of cactus - marching into to C live broadcast (1)
-bash: telnet: command not found的解决方法
MySQL-IFNULL处理N/A
【5G NR】NGAP协议之NG Setup
The song of cactus - marching into to C live broadcast (2)
Error encountered while importing keras typeerror: descriptors cannot not be created directly If this call came from a _
5G终端标识SUPI,SUCI及IMSI解析
[NAND file system] UBI introduction
八锁问题详解
[5g NR] mobile phone ID number IMEI and imeisv
Surfer grid file clipping
Blog add mailbox private message shortcut
Usage of trim, ltrim and rtrim functions of Oracle
tp6链接sqlserver,php链接sqlserver,linux离线安装与部署超详细
安装boost
Pytest数据参数化&数据驱动

![[5g NR] UE registration management status](/img/e6/2415ea09b5faa4c5f204d8d67dbb6a.png)






