Writeups/Ethernaut/NaughtCoin
MediumEthernaut · Ethernaut2024

NaughtCoin

Timelock Modifier Only on transfer(), Not transferFrom()

The 10-year timelock modifier is applied only to `transfer()`. The inherited ERC20 `transferFrom()` is unrestricted. Approving a spender and calling `transferFrom()` bypasses the lock entirely.

SolidityERC20allowancetransferFromModifier Bypass

00Overview

The 10-year timelock modifier is applied only to `transfer()`. The inherited ERC20 `transferFrom()` is unrestricted. Approving a spender and calling `transferFrom()` bypasses the lock entirely.

01Approve a spender for the full balance

javascript
await contract.approve(player, await contract.balanceOf(player))

02Use transferFrom to bypass the timelock

javascript
await contract.transferFrom(player, "0xdead...", await contract.balanceOf(player))

03Level Completed

NaughtCoin — completion screenshot 1