You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+17-59Lines changed: 17 additions & 59 deletions
Original file line number
Diff line number
Diff line change
@@ -31,71 +31,29 @@ forge test
31
31
```
32
32
33
33
## Tutorial Explanation
34
-
Our tutorial is simple. We have different files in the `/src` folder, each representing a smart contract with an issue. To simulate the issue's solution, you will find it in the `/test` file, which has the same name as that in the `/src` file. For example, the contract `/src/BankV1.sol` has its solution in `/test/BankV1.t.sol`.
35
34
36
-
### Tutorial Start (Challenge 1)
37
-
We have a group of people who want to start a new business and build their first Smart Contract on BlockChain, they came from a Web2 background with some information in Bank Systems, and they wanted to make a Decentralized Bank system in Web3.
35
+
Our tutorial contains 5 challenges you will find all of them in `/challenges` folder.
38
36
39
-
They started their project, by building the logic of bank contracts similar to Banks in Web2. The Bank stores Clients in `activatedAccounts`. Each client should have a password that will be used to authenticate withdrawals. and there is `accountsBalances` that stores the balance of clients. They made all variables private to prevent anyone from reading them.
37
+
We have 5 challenges:
38
+
- BankV1
39
+
- BankV2
40
+
- BankV3
41
+
- BankV4
42
+
- BankV5
40
43
41
-
Users started to use the bank, `Ahmed` has put `1 ETH` on the bank, after he created a password. But Ahmed noticed that his balance gets decreased to `0`, and someone withdrawed his balance, which means he knows `Ahmed` password, and Ahmed didn't say his password to any one.
44
+
They are sequence challenges you need to understand the first one to come to the second, and the second to come to the third etc...
42
45
43
-
Ahmed contacted Bank Support and Bank Supports gets a lot of issues like this.
46
+
For the solutions to the challenges, you will find them in `/solutions` folder. And for the simulation of the attack, you can go to `/test` folder that contains written POCs for the attack that can occur for all challenges.
44
47
45
-
You need to know what is the problem that allows anyone to withdraw, and how anyone can see the passwords and information of other accounts.
46
-
47
-
---
48
-
49
-
### Challenge 2
50
-
After the Team understood the Blockchain System, where everything is public, and no one can store secret information, They made another version.
51
-
52
-
The new version `BankV2` is simpler. They made a simple Bank system that allows accepting and withdrawing ETH, the project is life and users starts using it.
53
-
54
-
The Bank Contract Ether increases, as users are depositing, but Bank Developers noticed that the Bank Ether balance is zero. They investigated the issue and found that just a single user withdrew his balance, but other users still had a balance in the Bank.
55
-
56
-
You need to know what is the problem that makes the Attacker being able to drain the Bank Balance.
57
-
58
-
---
59
-
60
-
### Challenge 3
61
-
The developers understood the concept of Reentrancy, and they understood that they should transfer balance in the end of execution.
62
-
63
-
They made a new version `BankV3`, and they chose `USDT` ERC20 token for their token instead of native Ether, they didn't do the mistake they did before, they implemented a feature in that version, that allows users to withdraw their tokens only, or they can withdraw, and after withdrawing they can call random function.
64
-
65
-
They launched the protocol, but they noticed that one user was able to take all the `USDT` balances in the Bank (same as BankV2).
66
-
67
-
You need to know what is the problem that makes the Attacker being able to drain the Bank Balance.
68
-
69
-
---
70
-
71
-
### Challenge 4
72
-
The Developers understood that making an Arbitrary call is dangerous, and they made another version.
73
-
74
-
In the new version `BankV4`, they removed the feature of withdrawing by doing a fallback function, and for more security, they implement the `BlackList` mechanism that allows them to prevent Bad actors from withdrawing their tokens (To combat money laundering).
75
-
76
-
After they launched the Protocol, they found that a User had put a large amount of tokens in the Bank, they received a call from an Authorized Entity, that this Wallet was a wallet for an attacker that just stolen some funds, and asked Bank Develeoprs to prevent him from withdrawing tokens.
77
-
78
-
Bank developers Blacklisted that user immediately after the call, and prevented him from withdrawing.
79
-
80
-
The Developers meet with Officials to plan to take that stolen money back and give it to that Entity to return it. But in the meeting when they decided to take that user money, they noticed that the user was able to withdraw his money, not only this, but he is also not a `BlackListed` user anymore.
81
-
82
-
You need to know what is the problem that makes the Attacker being able to withdraw his balance although it gets blacklisted by developers.
83
-
84
-
---
85
-
86
-
### Challenge 5
87
-
The developers learned the lesson that they should understand the libraries they are using, and they made a new version.
88
-
89
-
In the new version `BankV5`, they decided to use `WETH` instead of `USDT`, with simple logic for deposit and withdrawing.
90
-
91
-
They launched there bank on Ethereum, everything is find, users are depositing and withdrawing easily, and no attack or unintended behavior occurs.
92
-
93
-
After a while, the number of Bank users increases, and it becomes a popular Bank on Ethereum BlockChain. The developers' business is growing, so they decided to extend their busniess and deploy their bank on `Arbitrum`.
94
-
95
-
After deploying on `Arbitrum`, and users starts using it on Arbitrum, they receive messages from clients that they are unable to withdraw their tokens. The Bank Developers are shocked by this as the Protocol is working fine on Ethereum, and withdrawal is not working on `Arbitrum`.
96
-
97
-
You need to know what is the problem that prevents withdrawing functionality from working on `Arbitrum`.
0 commit comments