《纸上谈兵·solidity》第 19 课：安全专题（一）—— 常见攻击手法与防御

function withdraw(uint _amount) external {
    require(balances[msg.sender] >= _amount, "Not enough");
    (bool ok, ) = payable(msg.sender).call{value: _amount}(""); // 外部调用
    require(ok);
    balances[msg.sender] -= _amount; // ❌ 状态更新过晚
}

function withdraw(uint _amount) external {
    require(balances[msg.sender] >= _amount, "Not enough");
    balances[msg.sender] -= _amount; // ✅ 先修改状态
    (bool ok, ) = payable(msg.sender).call{value: _amount}("");
    require(ok, "Transfer failed");
}

import "@openzeppelin/contracts/utils/ReentrancyGuard.sol";

contract SafeVault is ReentrancyGuard {
    mapping(address => uint) public balances;

    function withdraw(uint _amount) external nonReentrant {
        require(balances[msg.sender] >= _amount);
        balances[msg.sender] -= _amount;
        payable(msg.sender).transfer(_amount);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

import "@openzeppelin/contracts/utils/ReentrancyGuard.sol";

contract SafeVictim is ReentrancyGuard {
    mapping(address => uint) public balances;

    function deposit() external payable {
        balances[msg.sender] += msg.value;
    }

    function withdraw(uint _amount) external nonReentrant {
        require(balances[msg.sender] >= _amount);
        balances[msg.sender] -= _amount;
        (bool ok,) = payable(msg.sender).call{value: _amount}("");
        require(ok);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

import "forge-std/Test.sol";
import "../src/SafeVictim.sol";
import "../src/Attacker.sol";

contract SafeVictimTest is Test {
    SafeVictim safe;
     Attacker attacker;

    function setUp() public {
        safe = new SafeVictim();
        attacker = new Attacker(address(safe));

        vm.deal(address(this), 10 ether);
    }

    function testSafeWithdraw() public {
    // 攻击者尝试攻击
    vm.deal(address(attacker), 1 ether);

    vm.expectRevert(); // 攻击应该失败
    attacker.attack{value: 1 ether}();
    }

    receive() external payable {}
}

➜  tutorial git:(main) ✗ forge test --match-path test/SafeVictim.t.sol -vvv

[⠊] Compiling...
[⠒] Compiling 3 files with Solc 0.8.30
[⠑] Solc 0.8.30 finished in 513.05ms
Compiler run successful!

Ran 1 test for test/SafeVictim.t.sol:SafeVictimTest
[PASS] testSafeWithdraw() (gas: 49870)
Suite result: ok. 1 passed; 0 failed; 0 skipped; finished in 5.86ms (1.28ms CPU time)

Ran 1 test suite in 165.82ms (5.86ms CPU time): 1 tests passed, 0 failed, 0 skipped (1 total tests)