Skip to content

Commit

Permalink
Update 2024-11-26-SECCON-CTF-13-Quals-Writeup.md
Browse files Browse the repository at this point in the history
  • Loading branch information
bshyuunn authored Nov 28, 2024
1 parent 9f4ab8f commit d5ad463
Showing 1 changed file with 3 additions and 3 deletions.
6 changes: 3 additions & 3 deletions _posts/2024-11-26-SECCON-CTF-13-Quals-Writeup.md
Original file line number Diff line number Diff line change
Expand Up @@ -63,7 +63,7 @@ contract TrillionEther {

The most apparent bug exists in the _newWallet function, where an uninitialized storage variables bug occurs. The wallet variable is declared as storage but is not properly initialized before assignment. Consequently, the data is written starting from storage slot 0.

```
```solidity
function _newWallet(bytes32 name, uint256 balance, address owner) internal returns (Wallet storage wallet) {
wallet = wallet;
wallet.name = name;
Expand All @@ -82,7 +82,7 @@ $ forge inspect TrillionEther storage-layout --pretty
```

The wallets array consists of the Wallet struct, which occupies three storage slots for each element:
```
```solidity
struct Wallet {
bytes32 name;
uint256 balance;
Expand All @@ -101,7 +101,7 @@ By manipulating the array length in slot 0, we can cause an integer overflow dur

Below is the exploit script that drains the contract:

```
```solidity
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;
Expand Down

0 comments on commit d5ad463

Please sign in to comment.