Ethernaut — Level 20— Denial
Before we proceed with the challenge, read my article about transfer, send and call functions. Now that you have a basic understanding about how these functions work, Lets jump into the challenge.
The Investigation
The owner of the contract is set during the constructor call and we can set the partner address by calling the setWithdrawPartner function. The goal of the challenge is to deny the owner from withdrawing funds.
If you look at the code, we see that as part of the withdraw function, a call function and a transfer function. We already know that the call function uses all the gas whenever triggered unless we specify the amount of gas to use as an argument.
partner.call{value:amountToSend}(“”);
owner.transfer(amountToSend);//Example of specifying the gas limit
partner.call{gas: 5000, value:amountToSend}(“”);
The Solution
When the partner.call function is triggered, it calls the partner contract’s fallback function where in we assert is called. What asset(false) does is — it will not refund the gas on failure unlike require or revert in older solidity version(s). So, As a result, there is no enough gas to execute the owner.transfer function and this is how we are able to prevent the owner from withdrawing funds.
Thanks for Reading!
