> For the complete documentation index, see [llms.txt](https://ret2basic.gitbook.io/ctfwriteup/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ret2basic.gitbook.io/ctfwriteup/web3-ctf/quillctf/weth-11.md).

# WETH-11

## Idea

Function execute() allows us to do arbitrary call on behalf of the WETH11 contract:

```solidity
    function execute(address receiver, uint256 amount, bytes calldata data) external nonReentrant {
        uint256 prevBalance = address(this).balance;
        Address.functionCallWithValue(receiver, data, amount);

        require(address(this).balance >= prevBalance, "flash loan not returned");
    }
```

This is RCE.

The WETH contract has 10 WETH at the beginning:

```solidity
    function setUp() public {
        weth = new WETH11();
        bob = makeAddr("bob");

        vm.deal(address(bob), 10 ether);
        vm.startPrank(bob);
        weth.deposit{value: 10 ether}();
        weth.transfer(address(weth), 10 ether);
        vm.stopPrank();
    }
```

We can call `transfer()` to collect all the WETH from this contract and call `withdrawAll()` to burn everything and get ETH back.

## PoC

{% embed url="<https://github.com/ret2basic/QuillCTF-PoC/blob/main/WETH11/test/PoC.t.sol>" %}