【以太坊开发】BeautyChain (BEC) 溢出漏洞分析

怼烎@ 2022-05-19 05:13 326阅读 0赞

> 前言  
> 2018年4月23日中午11点30分左右，BEC代币被Hacker攻击。  
> Hacker利用数据溢出的漏洞攻击与美图合作的公司美链 BEC 的智能合约，成功地向两个地址转出了天量级别的 BEC 代币，导致市场上海量 BEC 被抛售，该数字货币价值几近归零，给 BEC 市场交易带来了毁灭性打击。  
> 下面我们来分析一下此次受攻击的漏洞，作为前车之鉴。

### 一、Token地址： ###

[https://etherscan.io/address/0xc5d105e63711398af9bbff092d4b6769c82f793d][https_etherscan.io_address_0xc5d105e63711398af9bbff092d4b6769c82f793d]

### 二、BEC智能合约源码 ###

我们不需要看完以下所有代码，重点关注第三节要分析的内容。

pragma solidity ^0.4.16;
    
    /**
     * @title SafeMath
     * @dev Math operations with safety checks that throw on error
     */
    library SafeMath {
      function mul(uint256 a, uint256 b) internal constant returns (uint256) {
        uint256 c = a * b;
        assert(a == 0 || c / a == b);
        return c;
      }
    
      function div(uint256 a, uint256 b) internal constant returns (uint256) {
        // assert(b > 0); // Solidity automatically throws when dividing by 0
        uint256 c = a / b;
        // assert(a == b * c + a % b); // There is no case in which this doesn't hold
        return c;
      }
    
      function sub(uint256 a, uint256 b) internal constant returns (uint256) {
        assert(b <= a);
        return a - b;
      }
    
      function add(uint256 a, uint256 b) internal constant returns (uint256) {
        uint256 c = a + b;
        assert(c >= a);
        return c;
      }
    }
    
    /**
     * @title ERC20Basic
     * @dev Simpler version of ERC20 interface
     * @dev see https://github.com/ethereum/EIPs/issues/179
     */
    contract ERC20Basic {
      uint256 public totalSupply;
      function balanceOf(address who) public constant returns (uint256);
      function transfer(address to, uint256 value) public returns (bool);
      event Transfer(address indexed from, address indexed to, uint256 value);
    }
    
    /**
     * @title Basic token
     * @dev Basic version of StandardToken, with no allowances.
     */
    contract BasicToken is ERC20Basic {
      using SafeMath for uint256;
    
      mapping(address => uint256) balances;
    
      /**
      * @dev transfer token for a specified address
      * @param _to The address to transfer to.
      * @param _value The amount to be transferred.
      */
      function transfer(address _to, uint256 _value) public returns (bool) {
        require(_to != address(0));
        require(_value > 0 && _value <= balances[msg.sender]);
    
        // SafeMath.sub will throw if there is not enough balance.
        balances[msg.sender] = balances[msg.sender].sub(_value);
        balances[_to] = balances[_to].add(_value);
        Transfer(msg.sender, _to, _value);
        return true;
      }
    
      /**
      * @dev Gets the balance of the specified address.
      * @param _owner The address to query the the balance of.
      * @return An uint256 representing the amount owned by the passed address.
      */
      function balanceOf(address _owner) public constant returns (uint256 balance) {
        return balances[_owner];
      }
    }
    
    /**
     * @title ERC20 interface
     * @dev see https://github.com/ethereum/EIPs/issues/20
     */
    contract ERC20 is ERC20Basic {
      function allowance(address owner, address spender) public constant returns (uint256);
      function transferFrom(address from, address to, uint256 value) public returns (bool);
      function approve(address spender, uint256 value) public returns (bool);
      event Approval(address indexed owner, address indexed spender, uint256 value);
    }
    
    
    /**
     * @title Standard ERC20 token
     *
     * @dev Implementation of the basic standard token.
     * @dev https://github.com/ethereum/EIPs/issues/20
     * @dev Based on code by FirstBlood: https://github.com/Firstbloodio/token/blob/master/smart_contract/FirstBloodToken.sol
     */
    contract StandardToken is ERC20, BasicToken {
    
      mapping (address => mapping (address => uint256)) internal allowed;
    
    
      /**
       * @dev Transfer tokens from one address to another
       * @param _from address The address which you want to send tokens from
       * @param _to address The address which you want to transfer to
       * @param _value uint256 the amount of tokens to be transferred
       */
      function transferFrom(address _from, address _to, uint256 _value) public returns (bool) {
        require(_to != address(0));
        require(_value > 0 && _value <= balances[_from]);
        require(_value <= allowed[_from][msg.sender]);
    
        balances[_from] = balances[_from].sub(_value);
        balances[_to] = balances[_to].add(_value);
        allowed[_from][msg.sender] = allowed[_from][msg.sender].sub(_value);
        Transfer(_from, _to, _value);
        return true;
      }
    
      /**
       * @dev Approve the passed address to spend the specified amount of tokens on behalf of msg.sender.
       *
       * Beware that changing an allowance with this method brings the risk that someone may use both the old
       * and the new allowance by unfortunate transaction ordering. One possible solution to mitigate this
       * race condition is to first reduce the spender's allowance to 0 and set the desired value afterwards:
       * https://github.com/ethereum/EIPs/issues/20#issuecomment-263524729
       * @param _spender The address which will spend the funds.
       * @param _value The amount of tokens to be spent.
       */
      function approve(address _spender, uint256 _value) public returns (bool) {
        allowed[msg.sender][_spender] = _value;
        Approval(msg.sender, _spender, _value);
        return true;
      }
    
      /**
       * @dev Function to check the amount of tokens that an owner allowed to a spender.
       * @param _owner address The address which owns the funds.
       * @param _spender address The address which will spend the funds.
       * @return A uint256 specifying the amount of tokens still available for the spender.
       */
      function allowance(address _owner, address _spender) public constant returns (uint256 remaining) {
        return allowed[_owner][_spender];
      }
    }
    
    /**
     * @title Ownable
     * @dev The Ownable contract has an owner address, and provides basic authorization control
     * functions, this simplifies the implementation of "user permissions".
     */
    contract Ownable {
      address public owner;
    
    
      event OwnershipTransferred(address indexed previousOwner, address indexed newOwner);
    
    
      /**
       * @dev The Ownable constructor sets the original `owner` of the contract to the sender
       * account.
       */
      function Ownable() {
        owner = msg.sender;
      }
    
    
      /**
       * @dev Throws if called by any account other than the owner.
       */
      modifier onlyOwner() {
        require(msg.sender == owner);
        _;
      }
    
    
      /**
       * @dev Allows the current owner to transfer control of the contract to a newOwner.
       * @param newOwner The address to transfer ownership to.
       */
      function transferOwnership(address newOwner) onlyOwner public {
        require(newOwner != address(0));
        OwnershipTransferred(owner, newOwner);
        owner = newOwner;
      }
    
    }
    
    /**
     * @title Pausable
     * @dev Base contract which allows children to implement an emergency stop mechanism.
     */
    contract Pausable is Ownable {
      event Pause();
      event Unpause();
    
      bool public paused = false;
    
    
      /**
       * @dev Modifier to make a function callable only when the contract is not paused.
       */
      modifier whenNotPaused() {
        require(!paused);
        _;
      }
    
      /**
       * @dev Modifier to make a function callable only when the contract is paused.
       */
      modifier whenPaused() {
        require(paused);
        _;
      }
    
      /**
       * @dev called by the owner to pause, triggers stopped state
       */
      function pause() onlyOwner whenNotPaused public {
        paused = true;
        Pause();
      }
    
      /**
       * @dev called by the owner to unpause, returns to normal state
       */
      function unpause() onlyOwner whenPaused public {
        paused = false;
        Unpause();
      }
    }
    
    /**
     * @title Pausable token
     *
     * @dev StandardToken modified with pausable transfers.
     **/
    
    contract PausableToken is StandardToken, Pausable {
    
      function transfer(address _to, uint256 _value) public whenNotPaused returns (bool) {
        return super.transfer(_to, _value);
      }
    
      function transferFrom(address _from, address _to, uint256 _value) public whenNotPaused returns (bool) {
        return super.transferFrom(_from, _to, _value);
      }
    
      function approve(address _spender, uint256 _value) public whenNotPaused returns (bool) {
        return super.approve(_spender, _value);
      }
      
      function batchTransfer(address[] _receivers, uint256 _value) public whenNotPaused returns (bool) {
        uint cnt = _receivers.length;
        uint256 amount = uint256(cnt) * _value;
        require(cnt > 0 && cnt <= 20);
        require(_value > 0 && balances[msg.sender] >= amount);
    
        balances[msg.sender] = balances[msg.sender].sub(amount);
        for (uint i = 0; i < cnt; i++) {
            balances[_receivers[i]] = balances[_receivers[i]].add(_value);
            Transfer(msg.sender, _receivers[i], _value);
        }
        return true;
      }
    }
    
    /**
     * @title Bec Token
     *
     * @dev Implementation of Bec Token based on the basic standard token.
     */
    contract BecToken is PausableToken {
        /**
        * Public variables of the token
        * The following variables are OPTIONAL vanities. One does not have to include them.
        * They allow one to customise the token contract & in no way influences the core functionality.
        * Some wallets/interfaces might not even bother to look at this information.
        */
        string public name = "BeautyChain";
        string public symbol = "BEC";
        string public version = '1.0.0';
        uint8 public decimals = 18;
    
        /**
         * @dev Function to check the amount of tokens that an owner allowed to a spender.
         */
        function BecToken() {
          totalSupply = 7000000000 * (10**(uint256(decimals)));
          balances[msg.sender] = totalSupply;    // Give the creator all initial tokens
        }
    
        function () {
            //if ether is sent to this address, send it back.
            revert();
        }
    }

### 三、漏洞所在处 ###

从上述源码中我们摘出`batchTransfer`这个函数，如下：

function batchTransfer(address[] _receivers, uint256 _value) public whenNotPaused returns (bool) {
        uint cnt = _receivers.length;
        uint256 amount = uint256(cnt) * _value; // <==== 败在这个乘法运算
        require(cnt > 0 && cnt <= 20);
        require(_value > 0 && balances[msg.sender] >= amount);
    
        balances[msg.sender] = balances[msg.sender].sub(amount); // 下面知道用库函数，却粗心在上一步没用
        for (uint i = 0; i < cnt; i++) {
            balances[_receivers[i]] = balances[_receivers[i]].add(_value);
            Transfer(msg.sender, _receivers[i], _value);
        }
        return true;
      }

这个函数的作用就是批量转账，其中我们可以看到有这么一句`uint256 amount = uint256(cnt) * _value;`，问题就出在这里，复现一下：  
1、给·`_receivers`参数传递两个或更多元素的数组，即`_receivers.length>=2`了，这里我们假定`_receivers.length=2`。  
2、给`_value`传一个什么样的值呢，要让`_value * 2 = 2 ** 256 + 1`刚好溢出，得到这个10 进制数`57896044618658097711785492504343953926634992332820282019728792003956564819968`，但笔者在Remix测试了一下，直接传这个数是不行的，要转换成16进制，即`0x8000000000000000000000000000000000000000000000000000000000000000`（8后面63个0），可以用`web3.fromDecimal('数字')`做一下转换。  
两个参数的值如下：

_value = 0x8000000000000000000000000000000000000000000000000000000000000000
    _receivers.length=2

这样就超出了`amount`的值范围，从而导致溢出归0，即`amount=0`，进而绕过了异常检查语句：

require(cnt > 0 && cnt <= 20);
    require(_value > 0 && balances[msg.sender] >= amount);

从攻击的参数中可以找到：

![700][]

3、再往下看for循环的加法运算，突破了前面的检查，到达for循环这里就如进入了无人看管的银库，想往自己账号上加多少钱就加多少，于是就有了下面这一幕：  
**BEC加钱现场：**  
[https://etherscan.io/tx/0xad89ff16fd1ebe3a0a7cf4ed282302c06626c1af33221ebe0d3a470aba4a660f][https_etherscan.io_tx_0xad89ff16fd1ebe3a0a7cf4ed282302c06626c1af33221ebe0d3a470aba4a660f]

### 四、单元测试 ###

针对以上的溢出漏洞，我们再来做个简单的测试：

pragma solidity ^0.4.18;
    
    contract BECTest {
        uint256 _value = 2**255;
        function mulTest() public constant returns (uint) {
            uint256 amount = 2 * _value;
            return amount;
        }
    }

在Remix中运行，可以看到运行结果为0.

![700 1][]

### 五、堵漏洞 ###

function batchTransfer(address[] _receivers, uint256 _value) public whenNotPaused returns (bool) {
        uint cnt = _receivers.length;
        uint256 amount = _value.mul(uint256(cnt)); // <===修改成这样即可
        require(cnt > 0 && cnt <= 20);
        require(_value > 0 && balances[msg.sender] >= amount);
    
        balances[msg.sender] = balances[msg.sender].sub(amount);
        for (uint i = 0; i < cnt; i++) {
            balances[_receivers[i]] = balances[_receivers[i]].add(_value);
            Transfer(msg.sender, _receivers[i], _value);
        }
        return true;
      }

或者

function batchTransfer(address[] _receivers, uint256 _value) public whenNotPaused returns (bool) {
        uint cnt = _receivers.length;
        uint256 amount = uint256(cnt) * _value; 
        require(cnt > 0 && cnt <= 20);
        require(_value > 0 && balances[msg.sender] >= amount);
        assert(amount / _value == cnt); // <===加上这么一句即可
    
        balances[msg.sender] = balances[msg.sender].sub(amount);
        for (uint i = 0; i < cnt; i++) {
            balances[_receivers[i]] = balances[_receivers[i]].add(_value);
            Transfer(msg.sender, _receivers[i], _value);
        }
        return true;
      }

### 总结 ###

1、BEC的整个合约源码读下来，设计模式很清晰，如图：

![576][]

2、用两个字来概括导致BEC破产的原因就是粗心。合约编写者并不是没有安全意识，在源码中我们看到SafeMath已经导入了，只是在这关键的一步没有使用SafeMath中的乘法`mul`方法，一失足成千古恨。  
3、在Solidity语言中最大可以处理256位数字，最大值为2 \*\* 256-1，再往上就会溢出归0。  
4、值得程序员警惕注意的是：在合约中做加减乘除运算时，一定要做溢出检查，使用SafeMath可以防止溢出问题。

参考：  
[https://github.com/OpenZeppelin/openzeppelin-solidity/blob/master/contracts/math/SafeMath.sol][https_github.com_OpenZeppelin_openzeppelin-solidity_blob_master_contracts_math_SafeMath.sol] 安全运算库

[https_etherscan.io_address_0xc5d105e63711398af9bbff092d4b6769c82f793d]: https://etherscan.io/address/0xc5d105e63711398af9bbff092d4b6769c82f793d
[700]: /images/20220519/8f1cc5922dc648519ede92ac5f0d8243.png
[https_etherscan.io_tx_0xad89ff16fd1ebe3a0a7cf4ed282302c06626c1af33221ebe0d3a470aba4a660f]: https://etherscan.io/tx/0xad89ff16fd1ebe3a0a7cf4ed282302c06626c1af33221ebe0d3a470aba4a660f
[700 1]: /images/20220519/9d41ac742cb4400f969a2d08d755f733.png
[576]: /images/20220519/29359f7db15b49528d74e6b3e42532a4.png
[https_github.com_OpenZeppelin_openzeppelin-solidity_blob_master_contracts_math_SafeMath.sol]: https://github.com/OpenZeppelin/openzeppelin-solidity/blob/master/contracts/math/SafeMath.sol