{"id":3324,"date":"2025-11-12T21:24:00","date_gmt":"2025-11-12T13:24:00","guid":{"rendered":"https:\/\/systw.net\/note\/?p=3324"},"modified":"2026-11-12T22:15:59","modified_gmt":"2026-11-12T14:15:59","slug":"ctf-token","status":"publish","type":"post","link":"https:\/\/systw.net\/note\/archives\/3324","title":{"rendered":"CTF Token"},"content":{"rendered":"\n

\u672c\u95dc\u5361\u5c55\u793a\u4e86\u5728 Solidity 0.8.0 \u4e4b\u524d\u7248\u672c\u4e2d\uff0c\u672a\u7d93\u4fdd\u8b77\u7684\u6578\u5b78\u904b\u7b97\u6240\u5e36\u4f86\u7684\u5b89\u5168\u98a8\u96aa\u3002\u653b\u64ca\u8005\u53ef\u4ee5\u5229\u7528\u6574\u6578\u4e0b\u6ea2\uff08Integer Underflow\uff09\u6f0f\u6d1e\uff0c\u7e5e\u904e\u9918\u984d\u6aa2\u67e5\u6a5f\u5236\uff0c\u6191\u7a7a\u70ba\u81ea\u5df1\u7684\u5e33\u6236\u5275\u9020\u51fa\u5de8\u91cf\u7684\u4ee3\u5e63\u3002<\/p>\n\n\n\n

\u984c\u76ee\u4f4d\u7f6e\uff1ahttps:\/\/ethernaut.openzeppelin.com\/level\/5<\/a><\/p>\n\n\n\n

\n\n\n\n

\u984c\u76ee\u8aaa\u660e<\/h2>\n\n\n\n

\u4f60\u4e00\u958b\u59cb\u6703\u7372\u5f97 20 \u679a\u4ee3\u5e63\uff08tokens\uff09\u3002\u900f\u904e\u99ed\u5165\u5408\u7d04\uff0c\u589e\u52a0\u4f60\u5e33\u6236\u5167\u7684\u4ee3\u5e63\u6578\u91cf\uff0c\u4f7f\u5176\u9060\u9060\u8d85\u904e\u521d\u59cb\u7684 20 \u679a\u3002<\/p>\n\n\n\n

\/\/ SPDX-License-Identifier: MIT\npragma solidity ^0.6.0;\n\ncontract Token {\n  mapping(address => uint) balances;\n  uint public totalSupply;\n\n  constructor(uint _initialSupply) public {\n    balances[msg.sender] = totalSupply = _initialSupply;\n  }\n\n  function transfer(address _to, uint _value) public returns (bool) {\n    require(balances[msg.sender] - _value >= 0);\n    balances[msg.sender] -= _value;\n    balances[_to] += _value;\n    return true;\n  }\n\n  function balanceOf(address _owner) public view returns (uint balance) {\n    return balances[_owner];\n  }\n}\n<\/code><\/pre>\n\n\n\n
\u4ee3\u78bc\u89e3\u8aaa<\/h2>\n\n\n\n
1. \u7248\u672c\u5ba3\u544a\u8207\u72c0\u614b\u8b8a\u6578<\/h3>\n\n\n\n
\/\/ SPDX-License-Identifier: MIT\npragma solidity ^0.6.0;\n\ncontract Token {\n    mapping(address => uint256) balances;\n    uint256 public totalSupply;<\/code><\/pre>\n\n\n\n
    \n
  • pragma solidity ^0.6.0;<\/code><\/strong>\uff1a\u9019\u662f\u6574\u500b\u5408\u7d04\u6700\u95dc\u9375\u7684\u80cc\u666f\u3002\u5728 Solidity 0.8.0 \u4e4b\u524d\uff0c\u7de8\u8b6f\u5668\u4e0d\u6703\u5728\u5e95\u5c64\u81ea\u52d5\u6aa2\u67e5\u6574\u6578\u904b\u7b97\u662f\u5426\u6ea2\u4f4d\u6216\u4e0b\u6ea2\u3002\u5982\u679c\u6c92\u6709\u4f9d\u8cf4\u5916\u90e8\u51fd\u5f0f\u5eab\uff08\u5982 OpenZeppelin \u7684 SafeMath<\/code>\uff09\uff0c\u904b\u7b97\u7d50\u679c\u767c\u751f\u6ea2\u4f4d\u6642\u6703\u76f4\u63a5\u300c\u7e5e\u8f49\uff08Wrap around\uff09\u300d\u3002<\/li>\n\n\n\n
  • balances<\/code><\/strong>\uff1a\u4e00\u500b\u96dc\u6e4a\u8868\uff08Mapping\uff09\uff0c\u7528\u4f86\u5c07\u4ee5\u592a\u574a\u5730\u5740\u6620\u5c04\u5230\u5176\u5c0d\u61c9\u7684\u4ee3\u5e63\u9918\u984d\u3002\u578b\u5225\u70ba uint256<\/code>\uff08\u7121\u7b26\u865f\u6574\u6578\uff0c\u7bc4\u570d\u662f 0 \u5230 2^{256}-1\uff09\u3002<\/li>\n\n\n\n
  • totalSupply<\/code><\/strong>\uff1a\u7d00\u9304\u9019\u500b\u4ee3\u5e63\u7684\u7e3d\u767c\u884c\u91cf\u3002<\/li>\n<\/ul>\n\n\n\n
    2. \u5efa\u69cb\u5b50 (Constructor)<\/h3>\n\n\n\n
        constructor(uint256 _initialSupply) public {
            balances[msg.sender] = totalSupply = _initialSupply;
        }<\/pre>\n\n\n\n
      \n
    • \u7576\u5408\u7d04\u88ab\u90e8\u7f72\u6642\u57f7\u884c\u3002\u5b83\u6703\u5c07\u4f7f\u7528\u8005\u50b3\u5165\u7684 _initialSupply<\/code> \u8a2d\u5b9a\u70ba\u7e3d\u767c\u884c\u91cf\uff0c\u4e26\u4e14\u628a\u6240\u6709\u7684\u521d\u59cb\u4ee3\u5e63\u90fd\u5206\u914d\u7d66\u90e8\u7f72\u5408\u7d04\u7684\u4eba\uff08msg.sender<\/code>\uff09\u3002<\/li>\n<\/ul>\n\n\n\n
      3. \u8f49\u5e33\u529f\u80fd\u8207\u6838\u5fc3\u6f0f\u6d1e (transfer)<\/h3>\n\n\n\n
          function transfer(address _to, uint256 _value) public returns (bool) {
              require(balances[msg.sender] - _value >= 0);
              balances[msg.sender] -= _value;
              balances[_to] += _value;
              return true;
          }<\/pre>\n\n\n\n
        \n
      • require<\/code>\uff1arequire(balances[msg.sender] - _value >= 0);<\/code> \u6aa2\u67e5\u767c\u9001\u8005\u662f\u5426\u6709\u8db3\u5920\u7684\u9918\u984d\u3002<\/li>\n\n\n\n
      • balances[msg.sender] -= _value;<\/code>  \u6e1b\u5c11balance\u7684\u9918\u984d  <\/li>\n<\/ul>\n\n\n\n
        4. \u9918\u984d\u67e5\u8a62 (balanceOf)<\/h3>\n\n\n\n
            function balanceOf(address _owner) public view returns (uint256 balance) {
                return balances[_owner];
            }<\/pre>\n\n\n\n
          \n
        • \u6a19\u6e96\u7684\u6aa2\u8996\u51fd\u6578\uff08view<\/code>\uff09\uff0c\u5141\u8a31\u4efb\u4f55\u4eba\u67e5\u8a62\u7279\u5b9a\u5730\u5740\u76ee\u524d\u7684\u4ee3\u5e63\u9918\u984d\u3002<\/li>\n<\/ul>\n\n\n\n
          \u5408\u7d04\u4e92\u52d5 <\/h3>\n\n\n\n
          \u5728 Ethernaut \u7684\u7db2\u9801\u958b\u767c\u8005\u5de5\u5177 (F12) \u7684 Console \u4e2d\uff0c\u53ef\u4ee5\u5148\u6a21\u64ec\u4e00\u6b21\u6b63\u5e38\u7684\u8f49\u5e33\u884c\u70ba\u3002\u5047\u8a2d\u8f49 1 \u679a\u4ee3\u5e63\u7d66\u4e00\u500b\u96a8\u6a5f\u5730\u5740\uff0c\u4f8b\u5982\u984c\u76ee\u7684\u5408\u7d04\u5be6\u9ad4\uff0c\u53ef\u4ee5\u767c\u73fe\u539f\u672c\u768420\u500btoken\u8b8a\u621019\u500btoken<\/p>\n\n\n\n
          \n> await contract.balanceOf(player);\n...omit...\n20\n...omit...\n> await contract.transfer(instance, 1);\n> await contract.balanceOf(player);\n...omit...\n19\n...omit...\n<\/code><\/pre>\n\n\n\n
          \n\n\n\n
          \u6f0f\u6d1e\u5206\u6790<\/h2>\n\n\n\n
          \u81f4\u547d\u7684\u6f0f\u6d1e\u5b58\u5728\u65bc transfer<\/code> \u51fd\u6578\u7684\u9019\u4e00\u884c\uff1a<\/p>\n\n\n\n
          require(balances[msg.sender] - _value >= 0);<\/code><\/pre>\n\n\n\n
          \u7531\u65bc balances<\/code> \u7684\u8cc7\u6599\u578b\u5225\u662f uint<\/code>\uff08\u7121\u7b26\u865f\u6574\u6578\uff0c\u5373\u6c38\u9060\u4e0d\u70ba\u8ca0\u6578\uff09\u3002\u7576\u6211\u5011\u5617\u8a66\u8a08\u7b97 20 - 21<\/code> \u6642\uff0c\u5728\u50b3\u7d71\u6578\u5b78\u4e2d\u7d50\u679c\u662f -1<\/code>\uff0c\u4f46\u5728 Solidity (< 0.8.0<\/code>) \u7684\u7121\u7b26\u865f\u6574\u6578\u4e16\u754c\u4e2d\uff0c\u6c92\u6709\u8ca0\u6578\u7684\u6982\u5ff5\u3002<\/p>\n\n\n\n
          \u7576\u6578\u503c\u4f4e\u65bc 0 \u6642\uff0c\u6703\u767c\u751f\u6574\u6578\u4e0b\u6ea2\uff08Underflow\uff09\uff0c\u6578\u503c\u6703\u7e5e\u8f49\uff08Wrap around\uff09\u56de\u5230\u8a72\u578b\u5225\u7684\u6700\u5927\u503c\u3002\u56e0\u6b64 20 - 21<\/code> \u7684\u904b\u7b97\u7d50\u679c\u6703\u8b8a\u6210 2^{256} – 1\uff08\u4e00\u500b\u6975\u5927\u7684\u6578\u5b57\uff09\u3002<\/p>\n\n\n\n
          \u56e0\u70ba 2^{256} – 1 > 0 \u6c38\u9060\u6210\u7acb\uff0c\u6240\u4ee5 require<\/code> \u7684\u6aa2\u67e5\u5fc5\u5b9a\u6703\u901a\u904e\u3002\u63a5\u8457\u57f7\u884c balances[msg.sender] -= _value;<\/code> \u6642\uff0c\u4f60\u7684\u9918\u984d\u5c31\u6703\u771f\u6b63\u5730\u767c\u751f\u4e0b\u6ea2\uff0c\u8b8a\u6210\u90a3\u500b\u6975\u5927\u7684\u6578\u5b57\u3002<\/p>\n\n\n\n
          \u89e3\u984c\u65b9\u6cd5 <\/h3>\n\n\n\n
          \u70ba\u4e86\u89f8\u767c\u4e0b\u6ea2\u6f0f\u6d1e\uff0c\u6211\u5011\u53ea\u9700\u8981\u8f49\u51fa\u300c\u6bd4\u76ee\u524d\u9918\u984d\u591a 1\u300d\u7684\u4ee3\u5e63\u6578\u91cf\u5373\u53ef\u3002\u4f60\u76ee\u524d\u7684\u9918\u984d\u61c9\u8a72\u662f 20\uff08\u6216\u525b\u525b demo \u5f8c\u7684 19\uff09\u3002<\/p>\n\n\n\n
          await contract.transfer(instance, 21);\nawait contract.balanceOf(player);<\/code><\/pre>\n\n\n\n
          \u67e5\u8a62\u76ee\u524d\u9918\u984d\u6703\u767c\u73fe\u8b8a\u6210\u4e00\u500b\u6975\u5927\u503c\u3002\u63a5\u8457\u9ede\u64ca\u7db2\u9801\u4e0b\u65b9\u7684 “Submit instance” \u5373\u53ef\u9806\u5229\u901a\u95dc\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"
          \u672c\u95dc\u5361\u5c55\u793a\u4e86\u5728 Solidity 0.8.0 \u4e4b\u524d\u7248\u672c\u4e2d\uff0c\u672a\u7d93\u4fdd\u8b77\u7684\u6578\u5b78\u904b\u7b97\u6240\u5e36\u4f86\u7684\u5b89\u5168\u98a8\u96aa\u3002\u653b\u64ca\u8005\u53ef\u4ee5\u5229\u7528\u6574\u6578\u4e0b\u6ea2\uff08Integer Underflow\uff09\u6f0f\u6d1e\uff0c\u7e5e\u904e\u9918\u984d\u6aa2\u67e5\u6a5f\u5236\uff0c\u6191\u7a7a\u70ba\u81ea\u5df1\u7684\u5e33\u6236\u5275\u9020\u51fa\u5de8\u91cf\u7684\u4ee3\u5e63\u3002<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"fifu_image_url":"","fifu_image_alt":"","_jetpack_hide_featured_image":false,"_jetpack_featured_image_duplicate_dismissed":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[371],"tags":[],"class_list":["post-3324","post","type-post","status-publish","format-standard","hentry","category-blockchain-security"],"jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":2589,"url":"https:\/\/systw.net\/note\/archives\/2589","url_meta":{"origin":3324,"position":0},"title":"SC Integer Overflow and Underflow","author":"raymond","date":"2024 \u5e74 8 \u6708 14 \u65e5","format":false,"excerpt":"\u6574\u6578\u6ea2\u4f4d\uff08Overflow\uff09\u8207\u4e0b\u6ea2\uff08Underflow\uff09\u662f\u667a\u80fd\u5408\u7d04\u4e2d\u7684\u4e00\u7a2e\u5b89\u5168\u6f0f\u6d1e\uff0c\u6e90\u65bc\u4ee5\u592a\u574a\u865b\u64ec\u6a5f\u2026","rel":"","context":"\u5728\u300cBlockchain Security\u300d\u4e2d","block_context":{"text":"Blockchain Security","link":"https:\/\/systw.net\/note\/archives\/category\/%e5%8d%80%e5%a1%8a%e9%8f%88\/blockchain-security"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":2556,"url":"https:\/\/systw.net\/note\/archives\/2556","url_meta":{"origin":3324,"position":1},"title":"OWASP Smart Contract Top 10","author":"raymond","date":"2025 \u5e74 8 \u6708 14 \u65e5","format":false,"excerpt":"\u96a8\u8457\u5340\u584a\u93c8\u548c\u667a\u80fd\u5408\u7d04\u7684\u8208\u8d77\uff0cOWASP \u4e5f\u767c\u5e03\u4e86 \u300cSmart Contract Top 10\u300d\uff0c\u9019\u2026","rel":"","context":"\u5728\u300cBlockchain Security\u300d\u4e2d","block_context":{"text":"Blockchain Security","link":"https:\/\/systw.net\/note\/archives\/category\/%e5%8d%80%e5%a1%8a%e9%8f%88\/blockchain-security"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":2584,"url":"https:\/\/systw.net\/note\/archives\/2584","url_meta":{"origin":3324,"position":2},"title":"SC Reentrancy","author":"raymond","date":"2024 \u5e74 8 \u6708 14 \u65e5","format":false,"excerpt":"\u91cd\u5165\u653b\u64ca\uff08Reentrancy Attack\uff09\u662f\u4e00\u7a2e\u667a\u80fd\u5408\u7d04\u4e2d\u7684\u6f0f\u6d1e\uff0c\u7576\u5408\u7d04\u5728\u66f4\u65b0\u81ea\u8eab\u72c0\u614b\uff08\u5982\u9918\u984d\uff09\u2026","rel":"","context":"\u5728\u300cBlockchain Security\u300d\u4e2d","block_context":{"text":"Blockchain Security","link":"https:\/\/systw.net\/note\/archives\/category\/%e5%8d%80%e5%a1%8a%e9%8f%88\/blockchain-security"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":3317,"url":"https:\/\/systw.net\/note\/archives\/3317","url_meta":{"origin":3324,"position":3},"title":"CTF Re-entrancy","author":"raymond","date":"2025 \u5e74 11 \u6708 11 \u65e5","format":false,"excerpt":"\u9019\u95dc\u7684\u6838\u5fc3\u65e8\u5728\u63ed\u793a Solidity \u4e2d\u6700\u60e1\u540d\u662d\u5f70\u7684\u6f0f\u6d1e\u4e4b\u4e00\uff1a\u91cd\u5165\u653b\u64ca\uff08Re-entrancy\uff09\u3002\u6b77\u2026","rel":"","context":"\u5728\u300cBlockchain Security\u300d\u4e2d","block_context":{"text":"Blockchain Security","link":"https:\/\/systw.net\/note\/archives\/category\/%e5%8d%80%e5%a1%8a%e9%8f%88\/blockchain-security"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":2791,"url":"https:\/\/systw.net\/note\/archives\/2791","url_meta":{"origin":3324,"position":4},"title":"Solidity\u8a9e\u6cd5\u6307\u5357","author":"raymond","date":"2025 \u5e74 9 \u6708 7 \u65e5","format":false,"excerpt":"Solidity \u662f\u7528\u65bc\u7de8\u5beb\u4ee5\u592a\u574a\u667a\u80fd\u5408\u7d04\u7684\u9ad8\u7d1a\u7a0b\u5f0f\u8a9e\u8a00\uff0c\u8a9e\u6cd5\u985e\u4f3c JavaScript\uff0c\u5c08\u70ba\u4ee5\u592a\u574a\u2026","rel":"","context":"\u5728\u300cSmart Contract\u300d\u4e2d","block_context":{"text":"Smart Contract","link":"https:\/\/systw.net\/note\/archives\/category\/%e5%8d%80%e5%a1%8a%e9%8f%88\/smart-contract-develop"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":2574,"url":"https:\/\/systw.net\/note\/archives\/2574","url_meta":{"origin":3324,"position":5},"title":"SC Improper Access Control","author":"raymond","date":"2024 \u5e74 8 \u6708 14 \u65e5","format":false,"excerpt":"\u5b58\u53d6\u63a7\u5236\u4e0d\u7576\u662f\u4e00\u7a2e\u667a\u80fd\u5408\u7d04\u4e2d\u7684\u5b89\u5168\u6f0f\u6d1e\uff0c\u6703\u5c0e\u81f4\u672a\u7d93\u6388\u6b0a\u7684\u4f7f\u7528\u8005\u80fd\u5920\u5b58\u53d6\u6216\u4fee\u6539\u5408\u7d04\u4e2d\u7684\u8cc7\u6599\u6216\u529f\u80fd\u3002\u9019\u7a2e\u2026","rel":"","context":"\u5728\u300cBlockchain Security\u300d\u4e2d","block_context":{"text":"Blockchain Security","link":"https:\/\/systw.net\/note\/archives\/category\/%e5%8d%80%e5%a1%8a%e9%8f%88\/blockchain-security"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]}],"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts\/3324","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/comments?post=3324"}],"version-history":[{"count":2,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts\/3324\/revisions"}],"predecessor-version":[{"id":3326,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts\/3324\/revisions\/3326"}],"wp:attachment":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/media?parent=3324"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/categories?post=3324"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/tags?post=3324"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}