Skip to content

Commit 9bae21e

Browse files
minaminaominaminao
committed
update readme + format
1 parent 9e32750 commit 9bae21e

File tree

25 files changed

+71
-57
lines changed

25 files changed

+71
-57
lines changed

‎README.md‎

Lines changed: 35 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,7 @@ Please be aware that these contain spoilers. For contribution guidelines, please
5858
- [Foundry cheatcodes](#foundry-cheatcodes)
5959
- [Front-running](#front-running)
6060
- [Back-running](#back-running)
61+
- [EIP-7702](#eip-7702)
6162
- [Head overflow bugs in calldata tuple ABI-reencoding (\< Solidity 0.8.16)](#head-overflow-bugs-in-calldata-tuple-abi-reencoding--solidity-0816)
6263
- [Overwriting storage slots via local storage variables (\< Solidity 0.8.1)](#overwriting-storage-slots-via-local-storage-variables--solidity-081)
6364
- [Overwriting arbitrary storage slots by setting array lengths to `2^256-1` (\< Solidity 0.6.0)](#overwriting-arbitrary-storage-slots-by-setting-array-lengths-to-2256-1--solidity-060)
@@ -356,28 +357,29 @@ Note:
356357
- Use a disassembler (e.g., [ByteGraph](https://bytegraph.xyz/), [ethersplay](https://github.com/crytic/ethersplay)).
357358
- Use a debugger (e.g., [Foundry Debugger](https://book.getfoundry.sh/forge/debugger)).
358359

359-
| Challenge | Note, Keywords |
360-
| --------------------------------------------------------------- | --------------------------------------- |
361-
| Incognito 2.0: Ez | keep in plain text |
362-
| [0x41414141 CTF: crackme.sol](src/0x41414141CTF/) | decompile |
363-
| [0x41414141 CTF: Crypto Casino](src/0x41414141CTF/) | bypass condition check |
364-
| Paradigm CTF 2021: Babyrev | |
365-
| 34C3 CTF: Chaingang | |
366-
| Blaze CTF 2018: Smart? Contract | |
367-
| DEF CON CTF Qualifier 2018: SAG? | |
368-
| pbctf 2020: pbcoin | |
369-
| Paradigm CTF 2022: STEALING-SATS | |
370-
| Paradigm CTF 2022: ELECTRIC-SHEEP | |
371-
| Paradigm CTF 2022: FUN-REVERSING-CHALLENGE | |
372-
| [DownUnderCTF 2022: EVM Vault Mechanism](src/DownUnderCTF2022/) | |
373-
| [EKOPARTY CTF 2022: Byte](src/EkoPartyCTF2022/) | stack tracing |
374-
| [EKOPARTY CTF 2022: SmartRev](src/EkoPartyCTF2022/) | memory tracing |
375-
| [Numen Cyber CTF 2023: HEXP](src/NumenCTF/) | previous block hash == gas price % 2^24 |
376-
| [BlazCTF 2023: Maze](src/BlazCTF2023/) | |
377-
| [BlazCTF 2023: Jambo](src/BlazCTF2023/) | |
378-
| [BlazCTF 2023: Ghost](src/BlazCTF2023/) | |
379-
| [Curta: Lana](src/Curta/20_Lana/) | LLVM |
380-
| [Ethernaut: 30. HigherOrder](src/Ethernaut/HigherOrder/) | calldata |
360+
| Challenge | Note, Keywords |
361+
| ------------------------------------------------------------------------------------ | --------------------------------------- |
362+
| Incognito 2.0: Ez | keep in plain text |
363+
| [0x41414141 CTF: crackme.sol](src/0x41414141CTF/) | decompile |
364+
| [0x41414141 CTF: Crypto Casino](src/0x41414141CTF/) | bypass condition check |
365+
| Paradigm CTF 2021: Babyrev | |
366+
| 34C3 CTF: Chaingang | |
367+
| Blaze CTF 2018: Smart? Contract | |
368+
| DEF CON CTF Qualifier 2018: SAG? | |
369+
| pbctf 2020: pbcoin | |
370+
| Paradigm CTF 2022: STEALING-SATS | |
371+
| Paradigm CTF 2022: ELECTRIC-SHEEP | |
372+
| Paradigm CTF 2022: FUN-REVERSING-CHALLENGE | |
373+
| [DownUnderCTF 2022: EVM Vault Mechanism](src/DownUnderCTF2022/) | |
374+
| [EKOPARTY CTF 2022: Byte](src/EkoPartyCTF2022/) | stack tracing |
375+
| [EKOPARTY CTF 2022: SmartRev](src/EkoPartyCTF2022/) | memory tracing |
376+
| [Numen Cyber CTF 2023: HEXP](src/NumenCTF/) | previous block hash == gas price % 2^24 |
377+
| [BlazCTF 2023: Maze](src/BlazCTF2023/) | |
378+
| [BlazCTF 2023: Jambo](src/BlazCTF2023/) | |
379+
| [BlazCTF 2023: Ghost](src/BlazCTF2023/) | |
380+
| [Curta: Lana](src/Curta/20_Lana/) | LLVM |
381+
| [Ethernaut: 30. HigherOrder](src/Ethernaut/HigherOrder/) | calldata |
382+
| [COMPFEST CTF 2025: Synthetic Manipulation](src/Compfest2025/SyntheticManipulation/) | |
381383

382384
### EVM assembly logic bugs
383385
- Logic bugs in assemblies such as Yul
@@ -529,9 +531,10 @@ Note:
529531
- This can be exploited in systems that track used signatures, as the alternative signature may not be recognized as already used.
530532
- In Ethereum's secp256k1 curve, this property can be used to bypass signature verification mechanisms.
531533

532-
| Challenge | Note, Keywords |
533-
| ---------------------------------------------------------- | ---------------------------------------- |
534-
| [SmileyCTF: MultisigWallet](src/SmileyCTF/MultisigWallet/) | ECDSA, signature malleability, secp256k1 |
534+
| Challenge | Note, Keywords |
535+
| ---------------------------------------------------------------------- | ---------------------------------------- |
536+
| [SmileyCTF: MultisigWallet](src/SmileyCTF/MultisigWallet/) | ECDSA, signature malleability, secp256k1 |
537+
| [COMPFEST CTF 2025: snake_inception](src/Compfest2025/SnakeInception/) | Vyper |
535538

536539
### Brute-forcing addresses
537540
- Brute force can make a part of an address a specific value.
@@ -620,6 +623,13 @@ Note:
620623
| [MEV-Share CTF: MevShareCTFNewContract (Address)](src/MEVShareCTF/) | |
621624
| [MEV-Share CTF: MevShareCTFNewContract (Salt)](src/MEVShareCTF/) | CREATE2 |
622625

626+
### EIP-7702
627+
628+
| Challenge | Note, Keywords |
629+
| --------------------------------------------------------------------------------------------------------------------------------------------------- | -------------- |
630+
| [HITCON CTF 2025: Maximal Extractable Vuln](https://github.com/minaminao/my-ctf-challenges/tree/main/ctfs/hitcon-ctf-2025/maximal-extractable-vuln) | |
631+
| [COMPFEST CTF 2025: snake_inception](src/Compfest2025/SnakeInception/) | Vyper |
632+
623633
### Head overflow bugs in calldata tuple ABI-reencoding (< Solidity 0.8.16)
624634
- See: https://blog.soliditylang.org/2022/08/08/calldata-tuple-reencoding-head-overflow-bug/
625635

‎src/Compfest2025/SnakeInception/README.md‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11

2-
Since the contract is using raw_call, no problem if it goes OOG.
2+
Since the contract is using raw_call, no problem if it goes OOG.
33

44
There are a signature in a past block:
55
```
@@ -20,3 +20,7 @@ Traces:
2020
Transaction successfully executed.
2121
Gas used: 68390
2222
```
23+
24+
25+
Other solutions
26+
- >minimal proxy with leading zero or eip 7702

‎src/Ethernaut/CoinFlip/CoinFlipFactory.sol‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ import "../Ethernaut/Level.sol";
66
import "./CoinFlip.sol";
77

88
contract CoinFlipFactory is Level {
9-
function createInstance(address /* _player */) public payable override returns (address) {
9+
function createInstance(address /* _player */ ) public payable override returns (address) {
1010
return address(new CoinFlip());
1111
}
1212

‎src/Ethernaut/Delegation/DelegationFactory.sol‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ contract DelegationFactory is Level {
1313
delegateAddress = address(newDelegate);
1414
}
1515

16-
function createInstance(address /* _player */) public payable override returns (address) {
16+
function createInstance(address /* _player */ ) public payable override returns (address) {
1717
Delegation parity = new Delegation(delegateAddress);
1818
return address(parity);
1919
}

‎src/Ethernaut/Denial/DenialFactory.sol‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,15 +8,15 @@ import "./Denial.sol";
88
contract DenialFactory is Level {
99
uint256 public initialDeposit = 0.001 ether;
1010

11-
function createInstance(address /* _player */) public payable override returns (address) {
11+
function createInstance(address /* _player */ ) public payable override returns (address) {
1212
require(msg.value >= initialDeposit);
1313
Denial instance = new Denial();
1414
(bool result,) = address(instance).call{value: msg.value}("");
1515
require(result);
1616
return address(instance);
1717
}
1818

19-
function validateInstance(address payable _instance, address /* _player */) public override returns (bool) {
19+
function validateInstance(address payable _instance, address /* _player */ ) public override returns (bool) {
2020
Denial instance = Denial(_instance);
2121
if (address(instance).balance <= 100 wei) {
2222
// cheating otherwise

‎src/Ethernaut/Elevator/ElevatorFactory.sol‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ import "../Ethernaut/Level.sol";
66
import "./Elevator.sol";
77

88
contract ElevatorFactory is Level {
9-
function createInstance(address /* _player */) public payable override returns (address) {
9+
function createInstance(address /* _player */ ) public payable override returns (address) {
1010
Elevator instance = new Elevator();
1111
return address(instance);
1212
}

‎src/Ethernaut/Fallback/FallbackFactory.sol‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ import "./Fallback.sol";
55
import "../Ethernaut/Level.sol";
66

77
contract FallbackFactory is Level {
8-
function createInstance(address /* _player */) public payable override returns (address) {
8+
function createInstance(address /* _player */ ) public payable override returns (address) {
99
Fallback instance = new Fallback();
1010
return address(instance);
1111
}

‎src/Ethernaut/Fallout/FalloutFactory.sol‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ import "../Ethernaut/Level.sol";
66
import "./Fallout.sol";
77

88
contract FalloutFactory is Level {
9-
function createInstance(address /* _player */) public payable override returns (address) {
9+
function createInstance(address /* _player */ ) public payable override returns (address) {
1010
Fallout instance = new Fallout();
1111
return address(instance);
1212
}

‎src/Ethernaut/Force/ForceFactory.sol‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,11 @@ import "../Ethernaut/Level.sol";
66
import "./Force.sol";
77

88
contract ForceFactory is Level {
9-
function createInstance(address /* _player */) public payable override returns (address) {
9+
function createInstance(address /* _player */ ) public payable override returns (address) {
1010
return address(new Force());
1111
}
1212

13-
function validateInstance(address payable _instance, address /* _player */) public view override returns (bool) {
13+
function validateInstance(address payable _instance, address /* _player */ ) public view override returns (bool) {
1414
Force instance = Force(_instance);
1515
return address(instance).balance > 0;
1616
}

‎src/Ethernaut/GatekeeperOne/GatekeeperOneFactory.sol‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ import "../Ethernaut/Level.sol";
66
import "./GatekeeperOne.sol";
77

88
contract GatekeeperOneFactory is Level {
9-
function createInstance(address /* _player */) public payable override returns (address) {
9+
function createInstance(address /* _player */ ) public payable override returns (address) {
1010
GatekeeperOne instance = new GatekeeperOne();
1111
return address(instance);
1212
}

0 commit comments

Comments
 (0)