Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

sunsec #969

Merged
merged 5 commits into from
Sep 23, 2024
Merged

sunsec #969

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
12457c9
Update greyhats-milotruck.md
SunWeb3Sec Sep 20, 2024
5ba9eab
Update greyhats-milotruck.md
SunWeb3Sec Sep 20, 2024
e4bdbf8
Update greyhats-milotruck.md
SunWeb3Sec Sep 21, 2024
d556bd5
Merge branch 'DeFiHackLabs:main' into main
SunWeb3Sec Sep 23, 2024
b45da36
Update SunSec.md
SunWeb3Sec Sep 23, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions SunSec.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -140,4 +140,12 @@ timezone: Asia/Taipei
- 準備比賽環境
- 建立群組隊伍

### 2024.09.21
- 進行 BlazCTF
- 爆肝

### 2024.09.22
- 進行 BlazCTF
- 爆肝

<!-- Content_END -->
6 changes: 3 additions & 3 deletions Writeup/SunSec/greyhats-milotruck.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@
uint256 fromShares = shares[from] - _shares; //vulnerable
uint256 toShares = shares[to] + _shares; //vulnerable
```
[POC:](./gratcat/test/greyhats-dollar.sol)
[POC:](./greyhats/test/greyhats-dollar.sol)
```
contract Exploit {
Setup setup;
Expand Down Expand Up @@ -82,7 +82,7 @@ contract Exploit {
解題:
- 當 ClonesWithImmutableArgs 代理被調用時，不可變參數和一個 2-byte 的長度字段會附加在委託調用（delegate call）的 calldata 中.
- tokenY 是 address(0)：address(0) 以 0x00 表示, tokenY 的最後一個 byte 為 0x00, 通過利用 ClonesWithImmutableArgs 的 calldata 優化, 我們可以省略 tokenY 的最後一個 byte, 並將未使用的 length field byte 作為 tokenY 的最後一個 byte, 你可以傳遞 19 bytes 的 0x00, 並且仍然能夠達到與傳遞完整 20 bytes 相同的效果, 計算出來的 paramsHash 會是一樣的, 這樣我們可以部署一樣的 escrowId 合約和覆蓋 owner.
[POC:](./gratcat/test/escrow.sol)
[POC:](./greyhats/test/escrow.sol)
```
function _getArgs() internal pure returns (address factory, address tokenX, address tokenY) {
// This function retrieves three arguments: factory, tokenX, and tokenY.
Expand Down Expand Up @@ -144,7 +144,7 @@ ERC-4626 太複雜了，所以我做了一個 AMM，能在股份與資產之間
- AMM 合約內預設題目上有 1000 SA shares 和 2000 grey 代幣, 在swap 功能中要滿足 computeK(reserveX, reserveY) >= k, AMM提供了 flashloan, 不用手續費.
- Vault 合約預設有 2000 grey 代幣. 可以透過flashloan 借出 1000 SA, 可以把 vault 上的 2000 grey 領走, 在把 1000 grey 存入拿到 1000 SA, 在歸還給 flashloan.
- 因為目前仍滿足 computeK(reserveX, reserveY) >= k, 1000+1000>= 2000, 所以可以透過 swap 使用 0 SA share 換出 1000 grey 代幣,
[POC:](./gratcat/test/simple-amm-vault.sol)
[POC:](./greyhats/test/simple-amm-vault.sol)

```
function solve() external {
Expand Down
Loading