Writeups/Ethernaut/Denial
MediumEthernaut · Ethernaut2024

Denial

Gas Exhaustion via Malicious Withdraw Partner

The contract sends a fixed 1% share to a partner before paying the owner. A malicious partner contract that enters an infinite loop in its `receive()` function consumes all available gas, preventing the owner's transfer from ever executing.

SolidityDoSGas Exhaustionwithdraw Pattern

00Overview

The contract sends a fixed 1% share to a partner before paying the owner. A malicious partner contract that enters an infinite loop in its `receive()` function consumes all available gas, preventing the owner's transfer from ever executing.

01Deploy a gas-consuming partner

javascript
contract DenialAttack {
    receive() external payable {
        // Infinite loop — exhausts all gas
        while (true) {}
    }
}

02Set as withdraw partner

javascript
await contract.setWithdrawPartner(attackAddress)

03Level Completed

Denial — completion screenshot 1