Add project2 challenge contracts

project2/badparity/README.md

@@ -0,0 +1,32 @@
+# Bad Parity
+
+## Story
+
+You are still working at an IT Security Consultant company called *AllmostAllsafe*.
+The biggest customer of *AllmostAllsafe* is *EveCorp*.
+*EveCorp* is highly interested in Blockchain and Smart Contract projects  lately (as almost every company...).
+After the great success of their fund raising DAO, the company wants to put their funds into a very secure *Wallet contract* so that all funds are better protected. 
+
+Therefore, they have decided to put their faith into a *Wallet contract* library form a subcontractor called *BadParity*.
+
+That is the story so far. 
+
+*ring ring late night emergency call*
+
+There is a major security breach within the wallet contracts of *BadParity* and you have to handle the incident response!
+Since it is a smart contract we cannot simply patch the vulnerability.
+Moreover, the admin of the customer who is under the controll of the keys for the *Wallet contract* is on vacation - therefore we cannot simply use those keys.
+
+To the rescue: It is your task to find the vulnerability, exploit it and withdraw all the money from the *Wallet contract* before an attacker can do that.
+
+## Technical description
+
+There is an instance of the *Wallet contract* for every student, initialized with a balance of `30` *EveCoins*. 
+The *Wallet contract* is of course owned by an *EveCorp* account, that is not under your control. 
+
+The challenge is solved when the balance of your *Wallet contract* is `0` 
+
+## Hints
+
+* http://hackingdistributed.com/2017/07/22/deep-dive-parity-bug/
+* http://solidity.readthedocs.io/en/v0.4.23/introduction-to-smart-contracts.html

project2/badparity/Wallet.abi

@@ -0,0 +1 @@
+[{"constant":false,"inputs":[{"name":"amount","type":"uint256"}],"name":"withdraw","outputs":[{"name":"","type":"bool"}],"payable":false,"stateMutability":"nonpayable","type":"function"},{"constant":true,"inputs":[],"name":"getOwner","outputs":[{"name":"","type":"address"}],"payable":false,"stateMutability":"view","type":"function"},{"constant":true,"inputs":[],"name":"getWalletLibrary","outputs":[{"name":"","type":"address"}],"payable":false,"stateMutability":"view","type":"function"},{"constant":false,"inputs":[{"name":"new_owner","type":"address"}],"name":"changeOwner","outputs":[{"name":"","type":"bool"}],"payable":false,"stateMutability":"nonpayable","type":"function"},{"constant":true,"inputs":[],"name":"getStudent","outputs":[{"name":"","type":"address"}],"payable":false,"stateMutability":"view","type":"function"},{"inputs":[{"name":"_student","type":"address"},{"name":"lib","type":"address"}],"payable":true,"stateMutability":"payable","type":"constructor"},{"payable":true,"stateMutability":"payable","type":"fallback"},{"anonymous":false,"inputs":[{"indexed":false,"name":"exitcode","type":"uint256"},{"indexed":false,"name":"amount","type":"uint256"}],"name":"LogValue","type":"event"}]

project2/badparity/Wallet.sol

@@ -0,0 +1,51 @@
+pragma solidity ^0.5.4;
+
+contract Wallet {
+    address walletLibrary;
+    address payable owner;
+    address payable student;
+
+    event LogValue(uint256 exitcode,uint256 amount);
+
+    // constructor, called once when this contract is created 
+    constructor(address payable _student, address lib) public payable {
+        student = _student;  
+        walletLibrary = lib; // hardcode lib address at deploy time
+        // init the owner with the respective lib contract
+        walletLibrary.delegatecall(abi.encodeWithSignature("initWallet(address)", msg.sender));
+    }
+
+    function getOwner() public view returns (address payable) {
+        return owner;
+    } 
+
+    function getWalletLibrary() public view returns (address) {
+        return walletLibrary;
+    }
+
+    function withdraw(uint256 amount) public returns (bool) {
+        (bool success, bytes memory data) = walletLibrary.delegatecall(abi.encodeWithSignature("withdraw(uint256)", amount));
+        if ( success ) {
+            emit LogValue(200,amount);
+        } else {
+            emit LogValue(401,amount);
+        }
+        return success;
+    }
+
+    function changeOwner(address payable new_owner) public returns (bool) {
+        (bool success, bytes memory data) = walletLibrary.delegatecall(abi.encodeWithSignature("changeOwner(address)", new_owner));
+        return success;
+    }
+
+    function getStudent() public view returns (address) {
+        return student;
+    }
+
+    // fallback function gets called if no other function matches call
+    function () external payable {
+        emit LogValue(301,msg.value);
+        require( tx.origin == student ); 
+        walletLibrary.delegatecall(msg.data);
+    }
+}

project2/badparity/WalletLibrary.abi

@@ -0,0 +1 @@
+[{"constant":false,"inputs":[{"name":"amount","type":"uint256"}],"name":"withdraw","outputs":[{"name":"success","type":"bool"}],"payable":false,"stateMutability":"nonpayable","type":"function"},{"constant":true,"inputs":[],"name":"getOwner","outputs":[{"name":"","type":"address"}],"payable":false,"stateMutability":"view","type":"function"},{"constant":false,"inputs":[{"name":"_owner","type":"address"}],"name":"initWallet","outputs":[],"payable":true,"stateMutability":"payable","type":"function"},{"constant":false,"inputs":[{"name":"new_owner","type":"address"}],"name":"changeOwner","outputs":[{"name":"success","type":"bool"}],"payable":false,"stateMutability":"nonpayable","type":"function"},{"payable":true,"stateMutability":"payable","type":"fallback"},{"anonymous":false,"inputs":[{"indexed":false,"name":"exitcode","type":"uint256"},{"indexed":false,"name":"amount","type":"uint256"}],"name":"LogValue","type":"event"}]

project2/badparity/WalletLibrary.bin

@@ -0,0 +1 @@
+608060405234801561001057600080fd5b506103fb806100206000396000f3fe60806040526004361061005c576000357c0100000000000000000000000000000000000000000000000000000000900480632e1a7d4d1461009e578063893d20e8146100f15780639da8be2114610148578063a6f9dae11461018c575b7fa9a26360ded17bbe6528a5ec42df34cc22964927204d7a69575e12c6839d426c60c834604051808381526020018281526020019250505060405180910390a1005b3480156100aa57600080fd5b506100d7600480360360208110156100c157600080fd5b81019080803590602001909291905050506101f5565b604051808215151515815260200191505060405180910390f35b3480156100fd57600080fd5b506101066102b5565b604051808273ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff16815260200191505060405180910390f35b61018a6004803603602081101561015e57600080fd5b81019080803573ffffffffffffffffffffffffffffffffffffffff1690602001909291905050506102df565b005b34801561019857600080fd5b506101db600480360360208110156101af57600080fd5b81019080803573ffffffffffffffffffffffffffffffffffffffff169060200190929190505050610323565b604051808215151515815260200191505060405180910390f35b6000600160009054906101000a900473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff163373ffffffffffffffffffffffffffffffffffffffff1614156102ab57600160009054906101000a900473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff166108fc839081150290604051600060405180830381858888f1935050505090506102b0565b600090505b919050565b6000600160009054906101000a900473ffffffffffffffffffffffffffffffffffffffff16905090565b80600160006101000a81548173ffffffffffffffffffffffffffffffffffffffff021916908373ffffffffffffffffffffffffffffffffffffffff16021790555050565b6000600160009054906101000a900473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff163373ffffffffffffffffffffffffffffffffffffffff1614156103c55781600160006101000a81548173ffffffffffffffffffffffffffffffffffffffff021916908373ffffffffffffffffffffffffffffffffffffffff160217905550600190506103ca565b600090505b91905056fea165627a7a723058205f88d4d451a7221ee85e4076f21abdd5b7040cb167545c1a755fb96263ea19160029

project2/badparity/WalletLibrary.sol

@@ -0,0 +1,38 @@
+pragma solidity ^0.5.4;
+
+contract WalletLibrary {
+     address walletLibrary; 
+     address payable owner;
+     address payable student;
+
+     event LogValue(uint256 exitcode,uint256 amount);
+
+     function initWallet(address payable _owner) public payable {
+        owner = _owner;
+     }
+
+     function getOwner() public view returns (address payable) {
+        return owner;
+     }
+
+     function changeOwner(address payable new_owner) public returns (bool success) {
+        if (msg.sender == owner) {
+            owner = new_owner;
+            return true;
+        } else {
+            return false;
+        }
+     }
+
+     function withdraw(uint256 amount) public returns (bool success) {
+         if (msg.sender == owner) {
+             return owner.send(amount);
+         } else {
+             return false;
+         }
+     }
+    
+     function () external payable {
+         emit LogValue(200,msg.value);
+     }
+}