Smart Contract Vulnerability Lab

A hands-on security lab demonstrating real-world Ethereum smart contract vulnerabilities and exploits.

---

Overview

This repository is a hands-on smart contract security lab that demonstrates real-world vulnerabilities in Ethereum-based applications.

Each module includes:

• A vulnerable contract
• An attacker implementation
• An executable script to simulate the exploit

The goal is to provide practical insight into:

• how vulnerabilities occur
• how they are exploited
• how they can be prevented

This project currently covers:

• Reentrancy attacks
• Access control vulnerabilities
• tx.origin Authentication Flaw
• Integer Overflow / Underflow

and is designed to expand with more security scenarios over time.

---

Vulnerability Comparison

Vulnerability	Root Cause	Impact
Reentrancy	State update after external call	Drain funds
Access Control	Missing permission checks	Unauthorized control
tx.origin	Improper authentication	Unauthorized access
Overflow	Unchecked arithmetic	State corruption

---

Attack Breakdown

1. Reentrancy Attack

• Deposit ETH into contract
• Call withdraw()
• Re-enter before balance updates
• Drain all funds

---

2. Access Control Attack

• No proper ownership validation
• Attacker calls restricted function
• Gains unauthorized control

---

3. tx.origin Attack

• Contract uses tx.origin for authentication
• Attacker tricks owner into calling malicious contract
• Malicious contract calls vulnerable contract
• Funds are stolen

---

4. Integer Overflow Attack

• Using unchecked arithmetic
• Value exceeds max limit
• Wraps around (e.g., 255 → 0)
• Leads to unexpected behavior

---

Execution

1. Reentrancy Attack

Location: contracts/reentrancy/

Run Reentrancy Attack

npx hardhat run scripts/reentrancy/reentrancyAttack.js

Result

---

2. Access Control Vulnerability

Location: contracts/access-control/

Run Access Control Attack

npx hardhat run scripts/access-control/accessControlAttack.js

Result

---

3. tx.origin Attack

Location: contracts/tx-origin/

Run tx.origin Attack

npx hardhat run scripts/tx-origin/txOriginAttack.js

Result

---

4 Overflow Attack

Location: contracts/overflow/

Run Access Control Attack

npx hardhat run scripts/tx-origin/txOriginAttack.js

Result

---

Learning

• Smart contracts are highly sensitive to execution order and external calls
• Updating state after external calls can lead to reentrancy vulnerabilities
• Improper authentication (e.g., tx.origin) can expose critical functions
• Arithmetic vulnerabilities can corrupt contract state
• Attackers exploit logical flaws, not just code bugs

This project emphasizes the importance of writing secure, well-audited smart contracts.

---

Prevention Techniques

• Use Checks-Effects-Interactions pattern
• Always use msg.sender instead of tx.origin
• Implement proper access control (onlyOwner, roles)
• Avoid unchecked arithmetic unless necessary
• Use call instead of transfer for flexibility
• Conduct thorough testing and security audits

---

Project Structure

contracts/ ├── reentrancy/ ├── access-control/ ├── tx-origin/ └── overflow/

scripts/ ├── reentrancy/ ├── access-control/ ├── tx-origin/ └── overflow/

attack-images/ README.md

---

Acknowledgement

This project was created by @bizzorotical-ank01 for educational purposes as part of a smart contract security learning journey.

It simulates real-world DeFi exploits to help developers understand:

• how vulnerabilities occur
• how attackers exploit them
• how to build secure smart contracts

Feel free to explore the code and documentation in this repository.

If you have any questions or suggestions, Let's Connect, Till then GOOD LUCK BUDDY!