Reentrancy Attack in Smart Contracts – Blockchainers
What is going to happen when the contract Etherstore send some ether to Attack contract? Let’s explain this process step by step.
In the first step the contract Attack will call the deposit function of contract Etherstore. The function will be called and executed with a parameter of 1 ether, so now the contract Attack has a balance of 1 ether.
After that, in the second step, the Attack contract will call the withdrawFund function of contract Etherstore with a parameter of 1 ether. Now in step 4 the withdrawFund function will be executed. As the balance of the contract Attack is 1 ether, because of step 1 and also the amount of withdraw is 1 ether because of the parameter we have passed in step 3, the requirements in step 5 and 6 will pass successfully.
Then, in step 7 the contract will send 1 ether to contract Attack so now the fallback function will be executed. As we told before the fallback function is executed when the contract has to handle an amount of ether.
In the beginning the total balance of EtherStore contract was 5 ether so now after the execution of the withdrawFund function is 4 ether. That means that now in step 8, where the fallback function is called, the condition in step 9 will pass successfully. Thus, the fallback function calls the EtherStore withdrawFund function again in step 10 and reenters the EtherStore contract.
In this second call of withdrawFund function, the Attack contract balance is still 1 ether because line 14 in contract EtherStore hasn’t executed yet. So, all the requirements (in steps 5 and 6) are passed.
Now the Attack contract withdraw 1 more ether.
Steps 4-10 will repeat until it is no longer the case that EtherStore.balance > 1 ether, meaning that EtherStore contract left with a balance of less than or equal to 1 ether.
Once there is 1 or less ether left in the EtherStore contract, this if statement in step 9 inside the fallback function will fail. This will then allow step “end” of EtherStore contract executed.
The balance in “end” step will be set and the execution will end.
The result is that the attacker has withdrawn all but 1 ether from the EtherStore contract in a single transaction.
So, as we can see (Figure 4), what is happening here is the execution of a recursive loop which actually forces contract EtherStore to execute the withdrawFund function until the contract left with a minimum or zero balance.
Published at Fri, 31 Jan 2020 07:56:41 +0000
{flickr|100|campaign}
