1. Victim 为含有漏洞的智能合约，在 Rinkeby 测试网络的合约地址为：
    2. 0x68D28fE315E6A344029D42915Fbc7af4261AB833
    3. 接口为：
    4. contract Victim {
    5.  function withdraw() public returns (string memory ){
    6.  return "ISCC{xxxxx}";
    7.  }
    8. }
    9. 请编写攻击合约，实现对 Victim 的攻击，获取 flag。

    也是给了个合约地址，继续访问https://rinkeby.etherscan.io/，搜索
    image.png
    在contract中点击decompile bytecode，反编译出来代码，拿到flag

    1. #
    2. #  Panoramix v4 Oct 2019 
    3. #  Decompiled source of rinkeby:0x68D28fE315E6A344029D42915Fbc7af4261AB833
    4. # 
    5. #  Let's make the world open source 
    6. # 
    7. #
    8. #  I failed with these: 
    9. #  - getBalance()
    10. #  All the rest is below.
    11. #
    13. def storage:
    14.   balances is mapping of uint256 at storage 0
    15.   unknown0568e65e is mapping of uint256 at storage 1
    16.   success is uint256 at storage 2
    17.   stor3 is uint256 at storage 3
    18.   stor4 is uint256 at storage 4
    20. def unknown0568e65e(addr _param1) payable: 
    21.   require calldata.size - 4 >= 32
    22.   return unknown0568e65e[_param1]
    24. def success() payable: 
    25.   return success
    27. def balances(address _param1) payable: 
    28.   require calldata.size - 4 >= 32
    29.   return balances[_param1]
    31. def getBalanceOf(address _address) payable: 
    32.   require calldata.size - 4 >= 32
    33.   return balances[addr(_address)]
    35. #
    36. #  Regular functions
    37. #
    39. def _fallback() payable: # default function
    40.   revert
    42. def withdraw() payable: 
    43.   if balances[caller]:
    44.       revert with 0, 'you have executed the withdrawal'
    45.   if success > 10:
    46.       if success >= 100:
    47.           stor4 = 2
    48.       else:
    49.           stor4 = 3
    50.   if unknown0568e65e[caller] == stor4:
    51.       success++
    52.   if unknown0568e65e[caller] < stor4:
    53.       unknown0568e65e[caller]++
    54.       call caller with:
    55.          value stor3 wei
    56.            gas gas_remaining wei
    57.       log 0xae0e6674: caller, stor3, bool(ext_call.success)
    58.   balances[caller] = stor3 * unknown0568e65e[caller]
    59.   if balances[caller] <= stor3:
    60.       revert with 0, 'failed to withdraw'
    61.   return 'ISCC{h@ve_fun~Re-EntRan(y}'

    yysy，这两道区块链题目真的是这么做的吗