We are given the following Solidity file that contains two contracts Delegate and Delegation. Get your new instance and open your console. According to the Solidity docs, delegatecall is similar to a call except it passes the original msg.sender and msg.value, rather than the contract making the call: There exists a special variant of a […]
Delegation | Ethernaut Level 6 Walk-Through Read More »
There’s a pool with 1000 ETH in balance, offering flash loans. It has a fixed fee of 1 ETH.A user has deployed a contract with 10 ETH in balance. It’s capable of interacting with the pool and receiving flash loans of ETH.Take all ETH out of the user’s contract. If possible, in a single transaction.
Naive receiver | Damn Vulnerable DeFi #2 Walk-Through Read More »
There’s a tokenized vault with a million DVT tokens deposited. It’s offering flash loans for free, until the grace period ends. To pass the challenge, make the vault stop offering flash loans. You start with 10 DVT tokens in balance. https://www.damnvulnerabledefi.xyz/challenges/unstoppable/ We are given two smart contracts ReceiverUnstoppable.sol and UnstoppableVault.sol and the unstoppable.challenge.js file to
Unstoppable | Damn Vulnerable DeFi #1 Walk-Through Read More »
As a continuation of my Web3 CTF walk-throughs I’m going to be starting on Damn Vulnerable DeFi, let this post guide us on installing and preparing our environment. Damn Vulnerable DeFi is the wargame to learn offensive security of DeFi smart contracts in Ethereum. Featuring flash loans, price oracles, governance, NFTs, DEXs, lending pools, smart
Damn Vulnerable DeFi Setup Read More »
Token asks us to hack the basic token contract supplied. We start with 20 tokens and our objective is to get our hands on more. We are given a hint that an odometer might be of help so let’s start by looking it up.An odometer is the mile tracker in your car that the numbers
Token | Ethernaut Level 5 Walk-Through Read More »
EVM puzzles gives us byte code and asks us for a value that will succeed as a transaction. If you missed my original post that goes more in detail about how to decipher the Opcodes and the tools we are using, see it here. Puzzle 2 introduces us to some new Opcodes, as well as
EVM Puzzles 2 Walk-Through Read More »
Telephone asks us to claim ownership of the contract. Learn the difference between tx.origin and msg.sender. It supplies us with the following source code: The contract seems simple enough, with just one function changeOwner we can see the requirements for claiming ownership: It seems that tx.origin can not (!=) equal the msg.sender. So let’s head
Telephone | Ethernaut Level 4 Walk-Through Read More »
10 consecutive correct guesses on a coin flip? There is a tiny chance we are gonna have to work the system. We are given the source code of the contract, it tracks consecutiveWins and has a flip function that takes in a bool _guess and returns a bool for heads or tails. Let’s take a
Coin Flip | Ethernaut Level 3 Walk-Through Read More »
Fallout or FAL1OUT as the hint in the image says, has an error in the code that incorrectly implements a constructor that leads to ownership transfer by any public address interacting with a specific function. This is the first level that suggests we try Solidity’s Remix IDE, a fully web based IDE for solidity with
Fallout | OpenZeppelin Ethernaut Level 2 Walk-Through Read More »
EVM Puzzles is a GitHub repo from fvictorio containing a collection of puzzles to teach how the EVM operates. For each challenge we are supplied with the bytecode of the contract, the objective is to send a successful transaction. In some puzzles you only need to provide the value that will be sent to the
How to Solve EVM Puzzles Read More »