blockchainmedium
False Bidding
hackthebox
Task: Become keyOwner in AuctionHouse contract by calling claimPrize() as top bidder after timeout passes. Solution: Exploit uint32 overflow on timeout variable (Solidity 0.7.x has no overflow protection) by performing 16 bid-withdraw cycles, bypassing blacklist by rejecting ETH in receive() function.
$ ls tags/ techniques/
uint32_overflowselective_payability_togglebid_withdraw_loopsingle_transaction_attackblacklist_bypass_via_revert
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Create a free account with GitHub, then upgrade to Pro.
$ssh [email protected]