- In the Wallet.sol line 18, use can send a message to trigger
initWallet
to become the owner. - Then the attacker can call
kill
the wallet by using the same technique. - References
Created
July 30, 2024 00:42
-
-
Save phunguyen19/157db75a072904faa3b5cab6a520d13b to your computer and use it in GitHub Desktop.
Snippet of Parity Multisig Wallet get hacked
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
contract Wallet is WalletEvents { | |
... | |
// METHODS | |
// gets called when no other function matches | |
function() payable { | |
// just being sent some cash? | |
if (msg.value > 0) | |
Deposit(msg.sender, msg.value); | |
else if (msg.data.length > 0) | |
_walletLibrary.delegatecall(msg.data); | |
} | |
... | |
// FIELDS | |
address constant _walletLibrary = | |
0xcafecafecafecafecafecafecafecafecafecafe; | |
} |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
contract WalletLibrary is WalletEvents { | |
... | |
// throw unless the contract is not yet initialized. | |
modifier only_uninitialized { if (m_numOwners > 0) throw; _; } | |
// constructor - just pass on the owner array to multiowned and | |
// the limit to daylimit | |
function initWallet(address[] _owners, uint _required, uint _daylimit) | |
only_uninitialized { | |
initDaylimit(_daylimit); | |
initMultiowned(_owners, _required); | |
} | |
// kills the contract sending everything to `_to`. | |
function kill(address _to) onlymanyowners(sha3(msg.data)) external { | |
suicide(_to); | |
} | |
... | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment