Ethernaut Locked with Solidity 0.5

Security Ethernaut
1

It doesn't look like the museum Locked level is still possible with Solidity 0.5 and may need to be removed/retired.

In Solidity 0.4.x we could declare NameRecord newRecord;, though we got the following warnings:

Warning: Variable is declared as a storage pointer. 
Use an explicit "storage" keyword to silence this warning.

Warning: Uninitialized storage pointer. Did you mean '\<type\> memory newRecord'?

Solidity 0.5 changed the warning for uninitialized storage pointers to an error:

https://solidity.readthedocs.io/en/latest/050-breaking-changes.html
Uninitialized storage variables are now disallowed.

The following code now errors in compilation with: DeclarationError: Uninitialized storage pointer. This means that the contract with the vulnerability cannot be compiled in Solidity 0.5

    function register(bytes32 _name, address _mappedAddress) public {
        // set up the new NameRecord
        NameRecord storage newRecord;
        newRecord.name = _name;
        newRecord.mappedAddress = _mappedAddress; 

        resolve[_name] = _mappedAddress;
        registeredNameRecord[msg.sender] = newRecord; 

        require(unlocked); // only allow registrations if contract is unlocked
    }

The walkthrough explains the original vulnerability:

1 Like
2

Great @abcoathup, thanks!

1 Like
3

We can retire the level. Checked with the author:

1 Like