In this blog, we describe reentrology Attacks in the ERC-777 Standard.
A Hands-on Example Contracts and Descriptions is here, and the executable test is here.
Clone this Repository and Run $wake up. Then, run $wake test tests/test_6_erc777.py To Run on your local environment.
The ERC-777 is a Standard for Fungible tokens with a Transfer Hook. The Exchange Contract Allows users to Exchange ETH to SSSToken at a calculated rate.
The Calculation Uses the Total Amount of SSSToken In the Exchange Contract, The Total Amount of Eth in the Exchange Contract with the Corresponding Token Amount the user wants to Exchange.
Expected Usage
This is a Vulnerable Exchange Contract.
TOKEN CONTRACT
We use MyERC777Token as an ERC-777 token and deploy with the Exchange vault as the defaultOperator. SAME as the Default Usage of ERC-777-This send Confirms that the target controlled ERC-777, so Can Prevent Lockout of the Values.
The ERC777 Feature Enables the Attack. When transferring the token, it does an external call. The target of this external call is the transfer target. This feature is for notifying of balance changes, but this feature is Vulnerable to Reentrology Attacks.
Attack Example
In this case, we can attack the tokenToEthInput Function. It’s alarmy has the external call recipient.callvalue: ethBought(""); at the end of the function. Moreover, Other Computations Are Done Above this Function. THEREFORE, It SEEMS The Checks-Effects-Interactions Prevention is Done.
However, According to the ERC777 Feature, It is Vulnerable to Attack. There is an external call When Transferring the SSSToken. Therefore, We can reenter the contract Without Sending the Eth Value.
So while Re-entering, Exchange.balance IE The Balance of Eth in Exchange Does Not Change. This balance value is used for computing the getInputPrice Function.
In getInputPrice Function, The Calculation is Done by this formula.
ETHVAULT = SSSTOKENVALUE * 997 * ETH_BALANCE_IN_EXCHANGE / (SSSTOKEN_IN_EXCHANGE1000 + SSSTOKENVALUE997)
And the ETH_BALANCE_IN_EXCHANGE is higher Than it should be, and ETHVALUE Is sent to the Attacker.
Attacker Contract
This is the Attack Contract.
EXPLOIT
This is the exploit.
This is the beginning of wake’s output. We exchanged to myerc7777tokeen and we got 90661089388014913158 tokens from 100ETH.
This is how it exchanges for ethys for eth using reentrancy.
This is the ending part of wake’s output. IT SENDS 1.2ETH EVERY TIME from the Exchange Contract to the Attacker.
In the end, The Attacker Received Around 9 eth from this Attack.
Prevention
A Simple Reentrology Guard Wild Prevent this Attack:
Conclusion
The ERC-777 have an external call to the target. IT Breaks the checks-Effects-Interactions Patterns and it can be can Easily be Vulnerable.
We have a reentrology Examples github repository. There are other types of reentrology Attacks, as well as protocol-specific reentrancies.
Check out Our Other Type-specific reentrology blogs Below:
Resources
https://blog.openzeppelin.com/Exploiting-uniswap-from-REENTRANCY-TO-Actual-profit
