---
title: "Discussion on \"Ethernaut Level 20 - Denial\" | Hashnode"
description: "Discussion on \"Ethernaut Level 20 - Denial\". Analysis and solution for Ethernaut's Level 20 - Denial, with Solidity and Foundry"
url: "https://hashnode.com/posts/ethernaut-level-20-denial/631397a6d49bb9d8c2f74594"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [Ethernaut Level 20 - Denial](https://blog.dixitaditya.com/ethernaut-level-20-denial?utm_source=hashnode&utm_medium=feed)

Analysis and solution for Ethernaut's Level 20 - Denial, with Solidity and Foundry

Sep 3, 2022 · 3 min read · blog.dixitaditya.com  
Read the article

-   [#ethernaut](https://hashnode.com/tag/ethernaut)
-   [#ethereum](https://hashnode.com/tag/ethereum)
-   [#security](https://hashnode.com/tag/security)
-   [#web3](https://hashnode.com/tag/web3)
-   [#solidity](https://hashnode.com/tag/solidity)

## Written by

[Aditya Dixit](https://hashnode.com/@adityadixit)

@adityadixit · India

  
[View profile](https://hashnode.com/@adityadixit)

Security Researcher

I'm leading the Research at Credshields, and Pentest teams at Cobalt Labs and HackerOne. I occasionally blog about my findings and adventures in pentesting.

## Responses 1

Markdown supported · ⌘↵ to post

[Stalin Javier Macias Gomez](https://hashnode.com/@stalinMaciasETH)

[Feb 1, 2023](https://hashnode.com/posts/ethernaut-level-20-denial/631397a6d49bb9d8c2f74594/comment/63d9f4e953c5735ee10df57a)

The first solution I came up with is exactly as yours, but I tested the edge case of sending a 1million gas from the attacker function into the withdraw() of the Denial contract, and this solution seems not to fit for this case, my guess is because the while(){} consumes all the gas of the second call() execution, (the one from the Denial service into the Attacker contract), but when the execution comes back to the denial contract, it still has a tons of gas, and the call to transfer funds to the owner still works....

I was just curious to test if the solution worked for the 1m gas because the challenge description states: "If you can deny the owner from withdrawing funds when they call withdraw() (whilst the contract still has funds, and the transaction is of 1M gas or less)"

Any thoughts about this?

[Aditya Dixit](https://hashnode.com/@adityadixit)

[Feb 4, 2023](https://hashnode.com/posts/ethernaut-level-20-denial/631397a6d49bb9d8c2f74594/comment/63d9f4e953c5735ee10df57a#reply-63dea11f22ecad9870b5e436)

Interesting. Can you share your PoC?