-
Notifications
You must be signed in to change notification settings - Fork 7
/
Copy pathsolving-paradigmctfs-jop-writeup.html
44 lines (38 loc) · 210 KB
/
solving-paradigmctfs-jop-writeup.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
<p>JOP is a Capture the Flag challenge created for ParadigmCTF 2021. This puzzle was not solved during the initial event — owing that to the extreme challenge it offers. As an aspiring security auditor, I felt that learning both JOP and Foundry together would be a great idea, and this post reflects the understanding I’ve gained from working with both.</p><h3>Brief Background</h3><h4>Why JOP?</h4><p>JOP poses a unique challenge in that you don't have the source code available! Poking holes in a program that you can't read is something I’ve wanted to try and would advocate others to try as well. Approaching problems through first-principles is a great guiding force, and learning the barebones bytecode will round out your skillset alongside Solidity.</p><p>Also, it currently does not have a hosted write-up explaining its intricacies and I wanted to fill this void.</p><h4><strong>Why Foundry?</strong></h4><p>Foundry separates itself from the pack with the combination of providing EVM cheatcodes and a kickass debugger. Being able to use <strong>prank()</strong> to change msg.sender, <strong>deal()</strong> to change balances, and especially <strong>load()</strong> & <strong>store()</strong> to read & alter storage slot values promotes quickly testing new ideas and speeds up the exploratory programming phase.</p><p>Foundry also is designed to have the user writing only Solidity. It’s a very enjoyable experience to stay in Solidity-mode rather than context switching between JS/Python for deployment and testing your ideas. </p><p>From a CTF-solver’s standpoint I only wish there were a storage change log. The record() and accesses() cheat codes are great, but a storage log would be useful to view storage location changes (slot & value) during debugging — especially so for the massive multi-step exploit functions that CTFs cater to. Nonetheless, I am quickly becoming a Foundry-main and only go to other debuggers like Remix for storage-related problems. Foundry is a dream to use, and we will do just fine solving JOP with what is available.</p><h4>Resources:</h4><p>ParadigmCTF source: https://github.com/paradigm-operations/paradigm-ctf-2021</p><p>Foundry: https://github.com/gakonst/foundry</p><p>My Solution Repo: https://github.com/plotchy/jop-foundry</p><p></p><h3>Let’s Look At The Challenge</h3><h4>Introductory Phase</h4><p>So where do you start? The challenge provides a Setup.sol file, some ERC20 dependencies, and a compilation output.</p><h5>Setup</h5><p>Setup.sol provides some guidance at the very beginning. We can see that the Challenge is initialized with two values <strong>(990, 1100)</strong>, and that a subsequent call is made to <strong>buyTokens()</strong> with 50 ether.</p><div class="captioned-image-container"><figure><a class="image-link image2" target="_blank" rel="nofollow" href="https://cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F4848a9cd-bcaf-495f-8f2d-5d06d8216def_701x365.png"><picture><source type="image/webp" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F4848a9cd-bcaf-495f-8f2d-5d06d8216def_701x365.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F4848a9cd-bcaf-495f-8f2d-5d06d8216def_701x365.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F4848a9cd-bcaf-495f-8f2d-5d06d8216def_701x365.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F4848a9cd-bcaf-495f-8f2d-5d06d8216def_701x365.png 1456w" sizes="100vw"><img src="https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/4848a9cd-bcaf-495f-8f2d-5d06d8216def_701x365.png" width="701" height="365" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/4848a9cd-bcaf-495f-8f2d-5d06d8216def_701x365.png","fullscreen":null,"imageSize":null,"height":365,"width":701,"resizeWidth":null,"bytes":58057,"alt":null,"title":null,"type":"image/png","href":null}" class="sizing-normal" alt="" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F4848a9cd-bcaf-495f-8f2d-5d06d8216def_701x365.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F4848a9cd-bcaf-495f-8f2d-5d06d8216def_701x365.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F4848a9cd-bcaf-495f-8f2d-5d06d8216def_701x365.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F4848a9cd-bcaf-495f-8f2d-5d06d8216def_701x365.png 1456w" sizes="100vw"></picture></a><figcaption class="image-caption">Screenshot of Setup.sol</figcaption></figure></div><p>We also know that we have three goals to accomplish with our exploit:</p><ul><li><p>Change the owner of the challenge contract to 0xdeaddead….</p></li><li><p>Have the ERC20 balance of the Setup contract be 0 — with regard to the Challenge ERC20 token.</p></li><li><p>Drain the Challenge contract of all ETH</p></li></ul><p>Before we dive in, we need to step back and do our first modifications to this challenge to have it work with Foundry. We need to re-create Setup to use the raw creation code we have in compiled.bin. </p><div class="captioned-image-container"><figure><a class="image-link image2" target="_blank" rel="nofollow" href="https://cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F07f3d053-28f9-4876-9d44-ae6c08d9c2bb_951x361.png"><picture><source type="image/webp" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F07f3d053-28f9-4876-9d44-ae6c08d9c2bb_951x361.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F07f3d053-28f9-4876-9d44-ae6c08d9c2bb_951x361.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F07f3d053-28f9-4876-9d44-ae6c08d9c2bb_951x361.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F07f3d053-28f9-4876-9d44-ae6c08d9c2bb_951x361.png 1456w" sizes="100vw"><img src="https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/07f3d053-28f9-4876-9d44-ae6c08d9c2bb_951x361.png" width="951" height="361" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/07f3d053-28f9-4876-9d44-ae6c08d9c2bb_951x361.png","fullscreen":null,"imageSize":null,"height":361,"width":951,"resizeWidth":null,"bytes":92458,"alt":null,"title":null,"type":"image/png","href":null}" class="sizing-normal" alt="" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F07f3d053-28f9-4876-9d44-ae6c08d9c2bb_951x361.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F07f3d053-28f9-4876-9d44-ae6c08d9c2bb_951x361.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F07f3d053-28f9-4876-9d44-ae6c08d9c2bb_951x361.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F07f3d053-28f9-4876-9d44-ae6c08d9c2bb_951x361.png 1456w" sizes="100vw"></picture></a><figcaption class="image-caption">Using create() to localize the challenge</figcaption></figure></div><p>We take the creation code from the Challenge.sol portion of combiled.bin, and we append our constructor arguments (990 & 1100) to the end using abi.encodePacked(). From here, we run create(), populate some helper variables for later, and call buyTokens() with 50 ether.</p><h5>Foundry Testing Suite</h5><p>We also want to set up our way of running our exploit. For the sake of simplicity, I have my Exploit contract create a new Setup contract which in turn creates a new Challenge contract.</p><div class="captioned-image-container"><figure><a class="image-link image2" target="_blank" rel="nofollow" href="https://cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F8d012505-cfc8-4043-878f-73ac06567df0_561x328.png"><picture><source type="image/webp" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F8d012505-cfc8-4043-878f-73ac06567df0_561x328.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F8d012505-cfc8-4043-878f-73ac06567df0_561x328.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F8d012505-cfc8-4043-878f-73ac06567df0_561x328.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F8d012505-cfc8-4043-878f-73ac06567df0_561x328.png 1456w" sizes="100vw"><img src="https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/8d012505-cfc8-4043-878f-73ac06567df0_561x328.png" width="561" height="328" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/8d012505-cfc8-4043-878f-73ac06567df0_561x328.png","fullscreen":null,"imageSize":null,"height":328,"width":561,"resizeWidth":null,"bytes":55718,"alt":null,"title":null,"type":"image/png","href":null}" class="sizing-normal" alt="" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F8d012505-cfc8-4043-878f-73ac06567df0_561x328.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F8d012505-cfc8-4043-878f-73ac06567df0_561x328.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F8d012505-cfc8-4043-878f-73ac06567df0_561x328.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F8d012505-cfc8-4043-878f-73ac06567df0_561x328.png 1456w" sizes="100vw"></picture></a><figcaption class="image-caption">Beginning of myExploit</figcaption></figure></div><p>In our Foundry project directory, we also add a myExploit.t.sol file, which is ran when we run <strong>forge test</strong> in the command line.</p><div class="captioned-image-container"><figure><a class="image-link image2" target="_blank" rel="nofollow" href="https://cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F8e73b67b-481f-4395-adf9-5202aac51feb_447x485.png"><picture><source type="image/webp" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F8e73b67b-481f-4395-adf9-5202aac51feb_447x485.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F8e73b67b-481f-4395-adf9-5202aac51feb_447x485.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F8e73b67b-481f-4395-adf9-5202aac51feb_447x485.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F8e73b67b-481f-4395-adf9-5202aac51feb_447x485.png 1456w" sizes="100vw"><img src="https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/8e73b67b-481f-4395-adf9-5202aac51feb_447x485.png" width="447" height="485" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/8e73b67b-481f-4395-adf9-5202aac51feb_447x485.png","fullscreen":null,"imageSize":null,"height":485,"width":447,"resizeWidth":null,"bytes":54697,"alt":null,"title":null,"type":"image/png","href":null}" class="sizing-normal" alt="" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F8e73b67b-481f-4395-adf9-5202aac51feb_447x485.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F8e73b67b-481f-4395-adf9-5202aac51feb_447x485.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F8e73b67b-481f-4395-adf9-5202aac51feb_447x485.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F8e73b67b-481f-4395-adf9-5202aac51feb_447x485.png 1456w" sizes="100vw"></picture></a><figcaption class="image-caption">Barebones myExploit.t.sol</figcaption></figure></div><p>Running <strong>forge test</strong></p><div class="captioned-image-container"><figure><a class="image-link image2" target="_blank" rel="nofollow" href="https://cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fcc106493-2e7d-43f8-9e3f-5369cc2346e3_420x57.png"><picture><source type="image/webp" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fcc106493-2e7d-43f8-9e3f-5369cc2346e3_420x57.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fcc106493-2e7d-43f8-9e3f-5369cc2346e3_420x57.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fcc106493-2e7d-43f8-9e3f-5369cc2346e3_420x57.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fcc106493-2e7d-43f8-9e3f-5369cc2346e3_420x57.png 1456w" sizes="100vw"><img src="https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/cc106493-2e7d-43f8-9e3f-5369cc2346e3_420x57.png" width="420" height="57" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/cc106493-2e7d-43f8-9e3f-5369cc2346e3_420x57.png","fullscreen":false,"imageSize":"normal","height":57,"width":420,"resizeWidth":420,"bytes":9118,"alt":null,"title":null,"type":"image/png","href":null}" class="sizing-normal" alt="" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fcc106493-2e7d-43f8-9e3f-5369cc2346e3_420x57.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fcc106493-2e7d-43f8-9e3f-5369cc2346e3_420x57.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fcc106493-2e7d-43f8-9e3f-5369cc2346e3_420x57.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fcc106493-2e7d-43f8-9e3f-5369cc2346e3_420x57.png 1456w" sizes="100vw"></picture></a><figcaption class="image-caption">Our basic Exploit deploys the Setup→Challenge chain successfully!</figcaption></figure></div><p></p><h4>The Power of Cheatcodes</h4><p>Before diving in to the bytecode of Challenge, we can first use the OP features of Foundry to learn more of our goals.</p><p>For instance, the verbose logging <strong>forge test -vvvvv</strong> will mark all calls taking place during the test. We can use this to our advantage to see which contracts become what addresses, how the overall call chaining looks between Exploit → Setup → Challenge, and view any emitted events that occurred during deployment. </p><p>Adding in cheatcodes <strong>record()</strong> and <strong>accesses()</strong> during our <strong>setUp()</strong> function will also expose the relevant storage slots written to during deployment. Altogether, our new testing code looks like this:</p><div class="captioned-image-container"><figure><a class="image-link image2" target="_blank" rel="nofollow" href="https://cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fe837443d-5833-4af4-8dbc-37a8ede48dac_836x424.png"><picture><source type="image/webp" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fe837443d-5833-4af4-8dbc-37a8ede48dac_836x424.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fe837443d-5833-4af4-8dbc-37a8ede48dac_836x424.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fe837443d-5833-4af4-8dbc-37a8ede48dac_836x424.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fe837443d-5833-4af4-8dbc-37a8ede48dac_836x424.png 1456w" sizes="100vw"><img src="https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/e837443d-5833-4af4-8dbc-37a8ede48dac_836x424.png" width="836" height="424" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/e837443d-5833-4af4-8dbc-37a8ede48dac_836x424.png","fullscreen":null,"imageSize":null,"height":424,"width":836,"resizeWidth":null,"bytes":76530,"alt":null,"title":null,"type":"image/png","href":null}" class="sizing-normal" alt="" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fe837443d-5833-4af4-8dbc-37a8ede48dac_836x424.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fe837443d-5833-4af4-8dbc-37a8ede48dac_836x424.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fe837443d-5833-4af4-8dbc-37a8ede48dac_836x424.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fe837443d-5833-4af4-8dbc-37a8ede48dac_836x424.png 1456w" sizes="100vw"></picture></a><figcaption class="image-caption">Adding in functions to CheatCodes, and placing them inside setUp()</figcaption></figure></div><p>And we run it with <strong>forge test -vvvvv</strong>, outputting:</p><div class="captioned-image-container"><figure><a class="image-link image2" target="_blank" rel="nofollow" href="https://cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F047d9044-c2c7-4080-84a0-6a8f53528edf_1284x662.png"><picture><source type="image/webp" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F047d9044-c2c7-4080-84a0-6a8f53528edf_1284x662.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F047d9044-c2c7-4080-84a0-6a8f53528edf_1284x662.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F047d9044-c2c7-4080-84a0-6a8f53528edf_1284x662.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F047d9044-c2c7-4080-84a0-6a8f53528edf_1284x662.png 1456w" sizes="100vw"><img src="https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/047d9044-c2c7-4080-84a0-6a8f53528edf_1284x662.png" width="1200" height="618.6915887850467" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/047d9044-c2c7-4080-84a0-6a8f53528edf_1284x662.png","fullscreen":false,"imageSize":"large","height":662,"width":1284,"resizeWidth":1200,"bytes":109214,"alt":null,"title":null,"type":"image/png","href":null}" class="sizing-large" alt="" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F047d9044-c2c7-4080-84a0-6a8f53528edf_1284x662.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F047d9044-c2c7-4080-84a0-6a8f53528edf_1284x662.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F047d9044-c2c7-4080-84a0-6a8f53528edf_1284x662.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F047d9044-c2c7-4080-84a0-6a8f53528edf_1284x662.png 1456w" sizes="100vw"></picture></a><figcaption class="image-caption">forge test -vvvvv Output</figcaption></figure></div><p>Wow! This is dense! Let’s break it down:</p><ol><li><p>We take note of each Contract:Address pair. This will be useful when inside the debugger later.</p><ol><li><p>myExploitTest = 0xb4c7…</p></li><li><p>myExploit = 0xce71…</p></li><li><p>mySetup = 0x037f…</p></li><li><p><Unknown> (Challenge) = 0x1276…</p></li></ol></li><li><p>We note the event that was emitted</p><ol><li><p>topic 0: 0xddf252…</p><ol><li><p>After a quick googling of 0xddf252, you’ll notice this is tied to the ERC20 Transfer event!</p></li></ol></li><li><p>topic 1-2: 0x0000 → 0x037f…</p><ol><li><p>The Transfer is occuring from the zero address to the mySetup contract.</p></li></ol></li><li><p>data: 0xa7b667…</p><ol><li><p>This is the amount! Converting the Hex value to Dec shows that this is a transfer of 49500 * 10**18 tokens.</p></li></ol></li></ol></li><li><p>We note the massive <strong>VM::accesses</strong> block. There are a few dozen entries in this block, not all of which are noteworthy.</p><ol><li><p>The 0x3c11… slot sticks out most. Through knowing how storage slots work in Solidity, we can deduce that this slot is produced through a keccak() hash, which are used in mappings. Knowing we had a Transfer event related to 49500 tokens, this relates to our mapping for _balances() and holds the balance that mySetup has in the ERC20 token.</p></li><li><p>We also know one of these slots holds the owner() value. We can’t deduce which one from this output, but we can creatively do so in the next section. 😉 </p></li></ol></li></ol><p></p><h5>Using isSolved() to our Advantage</h5><p>Knowing that we can view storage slots that are accessed during tests, let’s use <strong>setup.isSolved()</strong> to our advantage to view which slot is peeked at for the owner() value.</p><p>Let’s make a new testing function named <strong>testViewIsSolved()</strong> and look at the storage slots accessed inside.</p><div class="captioned-image-container"><figure><a class="image-link image2" target="_blank" rel="nofollow" href="https://cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fe41cf82b-d395-4231-8545-e7830587bd90_515x119.png"><picture><source type="image/webp" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fe41cf82b-d395-4231-8545-e7830587bd90_515x119.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fe41cf82b-d395-4231-8545-e7830587bd90_515x119.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fe41cf82b-d395-4231-8545-e7830587bd90_515x119.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fe41cf82b-d395-4231-8545-e7830587bd90_515x119.png 1456w" sizes="100vw"><img src="https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/e41cf82b-d395-4231-8545-e7830587bd90_515x119.png" width="515" height="119" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/e41cf82b-d395-4231-8545-e7830587bd90_515x119.png","fullscreen":null,"imageSize":null,"height":119,"width":515,"resizeWidth":null,"bytes":19603,"alt":null,"title":null,"type":"image/png","href":null}" class="sizing-normal" alt="" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fe41cf82b-d395-4231-8545-e7830587bd90_515x119.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fe41cf82b-d395-4231-8545-e7830587bd90_515x119.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fe41cf82b-d395-4231-8545-e7830587bd90_515x119.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fe41cf82b-d395-4231-8545-e7830587bd90_515x119.png 1456w" sizes="100vw"></picture></a><figcaption class="image-caption">Record the slots accessed for solving the puzzle </figcaption></figure></div><p>Run <strong>forge test -vvvvv -m testViewIsSolved</strong>, outputting:</p><div class="captioned-image-container"><figure><a class="image-link image2" target="_blank" rel="nofollow" href="https://cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F5a2bd960-e281-4ad8-8031-77bb3486dcfc_698x245.png"><picture><source type="image/webp" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F5a2bd960-e281-4ad8-8031-77bb3486dcfc_698x245.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F5a2bd960-e281-4ad8-8031-77bb3486dcfc_698x245.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F5a2bd960-e281-4ad8-8031-77bb3486dcfc_698x245.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F5a2bd960-e281-4ad8-8031-77bb3486dcfc_698x245.png 1456w" sizes="100vw"><img src="https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/5a2bd960-e281-4ad8-8031-77bb3486dcfc_698x245.png" width="698" height="245" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/5a2bd960-e281-4ad8-8031-77bb3486dcfc_698x245.png","fullscreen":null,"imageSize":null,"height":245,"width":698,"resizeWidth":null,"bytes":45293,"alt":null,"title":null,"type":"image/png","href":null}" class="sizing-normal" alt="" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F5a2bd960-e281-4ad8-8031-77bb3486dcfc_698x245.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F5a2bd960-e281-4ad8-8031-77bb3486dcfc_698x245.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F5a2bd960-e281-4ad8-8031-77bb3486dcfc_698x245.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F5a2bd960-e281-4ad8-8031-77bb3486dcfc_698x245.png 1456w" sizes="100vw"></picture></a></figure></div><p>In the <strong>VM::accesses</strong> block, we notice a slot being read, 0x05! Now we know owner() is stored here. To explain why only one slot was accessed despite there being 3 conditions in <strong>isSolved()</strong>, Solidity <strong>if()</strong> statements work with short-circuiting, so the <strong>isSolved() </strong>function failed on the first condition. We can’t view any further until we find the solution for that first condition. Are we stuck?</p><h5>Unless….</h5><p>This is where the power of Foundry truly comes to form. </p><p>We can use a cheat code to manipulate the slot and pass the first condition. We will use <strong>store() </strong>to change the value of slot 5 to the 0xdeaddead… address.</p><p>First, let’s take a look inside to see how the owner() slot is used. We’d expect it to match the deployer which would be the mySetup address (0x037f..)</p><div class="captioned-image-container"><figure><a class="image-link image2" target="_blank" rel="nofollow" href="https://cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fa6e13fc4-d607-45d1-8e1a-c6bf41aa58e8_1014x487.png"><picture><source type="image/webp" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fa6e13fc4-d607-45d1-8e1a-c6bf41aa58e8_1014x487.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fa6e13fc4-d607-45d1-8e1a-c6bf41aa58e8_1014x487.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fa6e13fc4-d607-45d1-8e1a-c6bf41aa58e8_1014x487.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fa6e13fc4-d607-45d1-8e1a-c6bf41aa58e8_1014x487.png 1456w" sizes="100vw"><img src="https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/a6e13fc4-d607-45d1-8e1a-c6bf41aa58e8_1014x487.png" width="1014" height="487" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/a6e13fc4-d607-45d1-8e1a-c6bf41aa58e8_1014x487.png","fullscreen":null,"imageSize":null,"height":487,"width":1014,"resizeWidth":null,"bytes":103372,"alt":null,"title":null,"type":"image/png","href":null}" class="sizing-normal" alt="" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fa6e13fc4-d607-45d1-8e1a-c6bf41aa58e8_1014x487.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fa6e13fc4-d607-45d1-8e1a-c6bf41aa58e8_1014x487.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fa6e13fc4-d607-45d1-8e1a-c6bf41aa58e8_1014x487.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fa6e13fc4-d607-45d1-8e1a-c6bf41aa58e8_1014x487.png 1456w" sizes="100vw"></picture></a><figcaption class="image-caption">Adding load() and store() cheatcodes, and using load() in our test function</figcaption></figure></div><p>Running <strong>forge test -vvvvv -m testViewIsSolved</strong> outputs:</p><div class="captioned-image-container"><figure><a class="image-link image2" target="_blank" rel="nofollow" href="https://cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F40335b50-1acd-405e-9e3c-77bb161ecdad_1041x138.png"><picture><source type="image/webp" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F40335b50-1acd-405e-9e3c-77bb161ecdad_1041x138.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F40335b50-1acd-405e-9e3c-77bb161ecdad_1041x138.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F40335b50-1acd-405e-9e3c-77bb161ecdad_1041x138.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F40335b50-1acd-405e-9e3c-77bb161ecdad_1041x138.png 1456w" sizes="100vw"><img src="https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/40335b50-1acd-405e-9e3c-77bb161ecdad_1041x138.png" width="1041" height="138" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/40335b50-1acd-405e-9e3c-77bb161ecdad_1041x138.png","fullscreen":null,"imageSize":null,"height":138,"width":1041,"resizeWidth":null,"bytes":31473,"alt":null,"title":null,"type":"image/png","href":null}" class="sizing-normal" alt="" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F40335b50-1acd-405e-9e3c-77bb161ecdad_1041x138.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F40335b50-1acd-405e-9e3c-77bb161ecdad_1041x138.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F40335b50-1acd-405e-9e3c-77bb161ecdad_1041x138.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F40335b50-1acd-405e-9e3c-77bb161ecdad_1041x138.png 1456w" sizes="100vw"></picture></a><figcaption class="image-caption">Notice the trailing …12 on the return of the VM::load() line</figcaption></figure></div><p>Turn your attention to the <strong>VM::load</strong> return line. As expected, our mySetup address (0x037f..) value is inside the slot. However, a keen eye notices that the end of the address normally ends with 0x..dd8f, and this slot shows it ending with a 0x…12? Huh? The answer is the slot shares it’s last byte with a previous variable following storage packing criteria. We aren’t sure what variable the 12 is tied to, but we do know it’s not being used for owner().</p><p>Now we know we need to fill the slot with 0xdeaddead…12. Let’s do so using <strong>store()</strong>:</p><div class="captioned-image-container"><figure><a class="image-link image2" target="_blank" rel="nofollow" href="https://cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fbf014b5f-7acb-46ff-a698-b8e3fa6a3d93_1170x319.png"><picture><source type="image/webp" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fbf014b5f-7acb-46ff-a698-b8e3fa6a3d93_1170x319.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fbf014b5f-7acb-46ff-a698-b8e3fa6a3d93_1170x319.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fbf014b5f-7acb-46ff-a698-b8e3fa6a3d93_1170x319.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fbf014b5f-7acb-46ff-a698-b8e3fa6a3d93_1170x319.png 1456w" sizes="100vw"><img src="https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/bf014b5f-7acb-46ff-a698-b8e3fa6a3d93_1170x319.png" width="1170" height="319" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/bf014b5f-7acb-46ff-a698-b8e3fa6a3d93_1170x319.png","fullscreen":null,"imageSize":null,"height":319,"width":1170,"resizeWidth":null,"bytes":64335,"alt":null,"title":null,"type":"image/png","href":null}" class="sizing-normal" alt="" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fbf014b5f-7acb-46ff-a698-b8e3fa6a3d93_1170x319.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fbf014b5f-7acb-46ff-a698-b8e3fa6a3d93_1170x319.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fbf014b5f-7acb-46ff-a698-b8e3fa6a3d93_1170x319.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fbf014b5f-7acb-46ff-a698-b8e3fa6a3d93_1170x319.png 1456w" sizes="100vw"></picture></a><figcaption class="image-caption">Placing 0xdead…12 into the 5th slot, and running forge test -vvvvv -m testViewIsSolved</figcaption></figure></div><p>Now we see that the VM::accesses block has a new entry! It worked! <strong>isSolved()</strong> is now checking the 0x311c… slot for the next condition. We knew from earlier that this slot houses the ERC20 balance of our mySetup contract, so this makes sense. We can repeat the <strong>store()</strong> command to place an ERC20 balance of 0 into that slot to solve the second condition.</p><div class="captioned-image-container"><figure><a class="image-link image2" target="_blank" rel="nofollow" href="https://cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9dcdef58-e1cd-4681-beed-61945981c48b_979x231.png"><picture><source type="image/webp" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9dcdef58-e1cd-4681-beed-61945981c48b_979x231.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9dcdef58-e1cd-4681-beed-61945981c48b_979x231.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9dcdef58-e1cd-4681-beed-61945981c48b_979x231.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9dcdef58-e1cd-4681-beed-61945981c48b_979x231.png 1456w" sizes="100vw"><img src="https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/9dcdef58-e1cd-4681-beed-61945981c48b_979x231.png" width="979" height="231" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/9dcdef58-e1cd-4681-beed-61945981c48b_979x231.png","fullscreen":null,"imageSize":null,"height":231,"width":979,"resizeWidth":null,"bytes":53063,"alt":null,"title":null,"type":"image/png","href":null}" class="sizing-normal" alt="" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9dcdef58-e1cd-4681-beed-61945981c48b_979x231.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9dcdef58-e1cd-4681-beed-61945981c48b_979x231.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9dcdef58-e1cd-4681-beed-61945981c48b_979x231.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9dcdef58-e1cd-4681-beed-61945981c48b_979x231.png 1456w" sizes="100vw"></picture></a><figcaption class="image-caption">Adding in the “ERC20 balance = 0” store()</figcaption></figure></div><p>Now that the first and second condition are solved, we know the third condition is that the Challenge contract has no ETH balance. We can use <strong>deal()</strong> to set the ETH balance to 0, and use an <strong>assertTrue()</strong> to check the return condition of <strong>isSolved()</strong> making sure we really are solving the challenge.</p><div class="captioned-image-container"><figure><a class="image-link image2" target="_blank" rel="nofollow" href="https://cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F88c38bcc-756d-4e84-8738-af51c4e3093f_976x254.png"><picture><source type="image/webp" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F88c38bcc-756d-4e84-8738-af51c4e3093f_976x254.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F88c38bcc-756d-4e84-8738-af51c4e3093f_976x254.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F88c38bcc-756d-4e84-8738-af51c4e3093f_976x254.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F88c38bcc-756d-4e84-8738-af51c4e3093f_976x254.png 1456w" sizes="100vw"><img src="https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/88c38bcc-756d-4e84-8738-af51c4e3093f_976x254.png" width="976" height="254" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/88c38bcc-756d-4e84-8738-af51c4e3093f_976x254.png","fullscreen":null,"imageSize":null,"height":254,"width":976,"resizeWidth":null,"bytes":59257,"alt":null,"title":null,"type":"image/png","href":null}" class="sizing-normal" alt="" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F88c38bcc-756d-4e84-8738-af51c4e3093f_976x254.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F88c38bcc-756d-4e84-8738-af51c4e3093f_976x254.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F88c38bcc-756d-4e84-8738-af51c4e3093f_976x254.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F88c38bcc-756d-4e84-8738-af51c4e3093f_976x254.png 1456w" sizes="100vw"></picture></a><figcaption class="image-caption">Adding in deal() and wrapping our isSolved() check with assertTrue()</figcaption></figure></div><p>Let’s run <strong>forge test -m testViewIsSolved:</strong></p><div class="captioned-image-container"><figure><a class="image-link image2" target="_blank" rel="nofollow" href="https://cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fd61be150-9239-4e0c-b536-d6959244611d_417x37.png"><picture><source type="image/webp" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fd61be150-9239-4e0c-b536-d6959244611d_417x37.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fd61be150-9239-4e0c-b536-d6959244611d_417x37.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fd61be150-9239-4e0c-b536-d6959244611d_417x37.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fd61be150-9239-4e0c-b536-d6959244611d_417x37.png 1456w" sizes="100vw"><img src="https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/d61be150-9239-4e0c-b536-d6959244611d_417x37.png" width="417" height="37" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/d61be150-9239-4e0c-b536-d6959244611d_417x37.png","fullscreen":null,"imageSize":null,"height":37,"width":417,"resizeWidth":null,"bytes":5909,"alt":null,"title":null,"type":"image/png","href":null}" class="sizing-normal" alt="" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fd61be150-9239-4e0c-b536-d6959244611d_417x37.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fd61be150-9239-4e0c-b536-d6959244611d_417x37.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fd61be150-9239-4e0c-b536-d6959244611d_417x37.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fd61be150-9239-4e0c-b536-d6959244611d_417x37.png 1456w" sizes="100vw"></picture></a><figcaption class="image-caption">Our insta-win test passes!</figcaption></figure></div><p>Hurray! We’ve ‘solved’ the challenge. This acts as an amazing sanity check. We now have a gameplan of which slots to attack with what values, and can begin stepping through the bytecode. </p><p></p><h3>Walking Through The Bytecode</h3><p>Let me give you a rough image of what we’re working with:</p><div class="captioned-image-container"><figure><a class="image-link image2" target="_blank" rel="nofollow" href="https://cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F90c63c63-6b5d-4083-979d-9c2e15a1db82_881x401.png"><picture><source type="image/webp" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F90c63c63-6b5d-4083-979d-9c2e15a1db82_881x401.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F90c63c63-6b5d-4083-979d-9c2e15a1db82_881x401.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F90c63c63-6b5d-4083-979d-9c2e15a1db82_881x401.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F90c63c63-6b5d-4083-979d-9c2e15a1db82_881x401.png 1456w" sizes="100vw"><img src="https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/90c63c63-6b5d-4083-979d-9c2e15a1db82_881x401.png" width="881" height="401" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/90c63c63-6b5d-4083-979d-9c2e15a1db82_881x401.png","fullscreen":null,"imageSize":null,"height":401,"width":881,"resizeWidth":null,"bytes":158620,"alt":null,"title":null,"type":"image/png","href":null}" class="sizing-normal" alt="" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F90c63c63-6b5d-4083-979d-9c2e15a1db82_881x401.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F90c63c63-6b5d-4083-979d-9c2e15a1db82_881x401.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F90c63c63-6b5d-4083-979d-9c2e15a1db82_881x401.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F90c63c63-6b5d-4083-979d-9c2e15a1db82_881x401.png 1456w" sizes="100vw"></picture></a><figcaption class="image-caption">😵 … It goes on for 18000+ characters…</figcaption></figure></div><p>Thankfully, we don’t need to hand annotate this brick wall. Instead we’re going to rely on a bytecode decompiler, and use the fantastic online version hosted at <a href="https://ethervm.io/">ethervm</a>. </p><p>If you plop this bytecode in as is, you aren’t going to get the correct output. The initcode found in the compiled.bin file is <em>creation </em>code and we are wanting to analyse the <em>runtime</em> code. The runtime code can be found by using a simple helper function like this:</p><div class="captioned-image-container"><figure><a class="image-link image2" target="_blank" rel="nofollow" href="https://cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fb4c635ce-6d21-47fd-b791-5ef83e7f53f8_271x99.png"><picture><source type="image/webp" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fb4c635ce-6d21-47fd-b791-5ef83e7f53f8_271x99.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fb4c635ce-6d21-47fd-b791-5ef83e7f53f8_271x99.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fb4c635ce-6d21-47fd-b791-5ef83e7f53f8_271x99.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fb4c635ce-6d21-47fd-b791-5ef83e7f53f8_271x99.png 1456w" sizes="100vw"><img src="https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/b4c635ce-6d21-47fd-b791-5ef83e7f53f8_271x99.png" width="271" height="99" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/b4c635ce-6d21-47fd-b791-5ef83e7f53f8_271x99.png","fullscreen":null,"imageSize":null,"height":99,"width":271,"resizeWidth":null,"bytes":12845,"alt":null,"title":null,"type":"image/png","href":null}" class="sizing-normal" alt="" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fb4c635ce-6d21-47fd-b791-5ef83e7f53f8_271x99.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fb4c635ce-6d21-47fd-b791-5ef83e7f53f8_271x99.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fb4c635ce-6d21-47fd-b791-5ef83e7f53f8_271x99.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fb4c635ce-6d21-47fd-b791-5ef83e7f53f8_271x99.png 1456w" sizes="100vw"></picture></a><figcaption class="image-caption">Simple runtime code emitter for any address</figcaption></figure></div><p>Or, I can let you know that there’s a very common pattern in Solidity where the <em>second</em> occurence of <strong>6080</strong> within the creation code is the beginning of the runtime code. This pattern is so common that ethervm also recommends you try this as a default. It works here too.</p><p>If you’d like to follow along with decompiling, visit <a href="https://github.com/plotchy/jop-foundry/blob/main/challenge.bin">this file</a> on my solution repo and copy & paste the 4th line’s <strong>Runtime only</strong> bytecode into <a href="https://ethervm.io/decompile">ethervm's decompiler</a>.</p><h5>Looking at the Decompiled runtime code</h5><p>The output of our runtime code is separated into 4 sections:</p><ul><li><p>Public methods</p><ul><li><p>All externally facing functions</p><ul><li><p>Some have names if they match registered functions from <a href="https://www.4byte.directory">4byte.directory</a></p></li></ul></li><li><p>Think of these as our entry points for the exploit</p></li></ul></li><li><p>Internal methods</p><ul><li><p>Functions that are called from inside the contract</p></li></ul></li><li><p>Decompilation</p><ul><li><p>Attempt to convert the contract back into Solidity-style language</p></li></ul></li><li><p>Disassembly</p><ul><li><p>Annotated opcodes sharing labelling from Internal Methods</p></li><li><p><em>Where we’re going to spend most of our time</em> 😁 </p></li></ul></li></ul><p>Starting with the Public methods, we want to look over the available entry points with our goals in mind: 1. Change the Owner, 2. Remove the ERC20 Balance, 3. Drain the ETH</p><div class="captioned-image-container"><figure><a class="image-link image2" target="_blank" rel="nofollow" href="https://cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F28637d8b-865b-4d6b-9932-a0beb4369d5f_484x629.png"><picture><source type="image/webp" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F28637d8b-865b-4d6b-9932-a0beb4369d5f_484x629.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F28637d8b-865b-4d6b-9932-a0beb4369d5f_484x629.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F28637d8b-865b-4d6b-9932-a0beb4369d5f_484x629.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F28637d8b-865b-4d6b-9932-a0beb4369d5f_484x629.png 1456w" sizes="100vw"><img src="https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/28637d8b-865b-4d6b-9932-a0beb4369d5f_484x629.png" width="484" height="629" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/28637d8b-865b-4d6b-9932-a0beb4369d5f_484x629.png","fullscreen":null,"imageSize":null,"height":629,"width":484,"resizeWidth":null,"bytes":113314,"alt":null,"title":null,"type":"image/png","href":null}" class="sizing-normal" alt="" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F28637d8b-865b-4d6b-9932-a0beb4369d5f_484x629.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F28637d8b-865b-4d6b-9932-a0beb4369d5f_484x629.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F28637d8b-865b-4d6b-9932-a0beb4369d5f_484x629.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F28637d8b-865b-4d6b-9932-a0beb4369d5f_484x629.png 1456w" sizes="100vw"></picture></a><figcaption class="image-caption">Public methods, emphasis mine</figcaption></figure></div><p>We see several familiar ERC20 functions, but most are irrelevant. For a starting point there are only about 7 functions that have a sensible relation to our goals. This is a welcome reduction of 23 → 7 functions that we’ll investigate further. </p><p>Skimming over the internal methods, we see that these consist of a lot of the previous methods along with label_XXXX() methods that we don’t understand much of yet. This section won’t largely come into play as the pure disassembly will prove to be more useful later on.</p><p>Moving onto Decompilation, you’ll notice familiar syntax that we’re used to. </p><div class="captioned-image-container"><figure><a class="image-link image2" target="_blank" rel="nofollow" href="https://cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9877e6ea-3939-4c88-9e49-21f992cd1c79_775x795.png"><picture><source type="image/webp" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9877e6ea-3939-4c88-9e49-21f992cd1c79_775x795.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9877e6ea-3939-4c88-9e49-21f992cd1c79_775x795.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9877e6ea-3939-4c88-9e49-21f992cd1c79_775x795.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9877e6ea-3939-4c88-9e49-21f992cd1c79_775x795.png 1456w" sizes="100vw"><img src="https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/9877e6ea-3939-4c88-9e49-21f992cd1c79_775x795.png" width="775" height="795" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/9877e6ea-3939-4c88-9e49-21f992cd1c79_775x795.png","fullscreen":null,"imageSize":null,"height":795,"width":775,"resizeWidth":null,"bytes":114262,"alt":null,"title":null,"type":"image/png","href":null}" class="sizing-normal" alt="" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9877e6ea-3939-4c88-9e49-21f992cd1c79_775x795.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9877e6ea-3939-4c88-9e49-21f992cd1c79_775x795.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9877e6ea-3939-4c88-9e49-21f992cd1c79_775x795.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9877e6ea-3939-4c88-9e49-21f992cd1c79_775x795.png 1456w" sizes="100vw"></picture></a><figcaption class="image-caption">Decompilation section</figcaption></figure></div><p>There are a few distinct differences from Solidity that will prove helpful to know:</p><ul><li><p><strong>main()</strong> is the starting point for <em>every</em> external call to the contract.</p><ul><li><p>Public methods are then entered depending on the data sent to the contract.</p></li></ul></li><li><p><strong>memory[X:X]</strong> refers directly to the EVM memory at that point in time.</p><ul><li><p>This is not typically accessible with Solidity unless you use an assembly{} block. </p></li><li><p>The [X:X] portion refers to a slice of that memory, typically in the form of bytes32 chunks.</p></li></ul></li><li><p><strong>label_XXXX</strong> refers to a jumping pattern.</p><ul><li><p>You may notice a <strong>goto label;</strong> syntax, which redirects control flow to the beginning of the label.</p></li><li><p>The XXXX portion refers to a specific <strong>JUMPDEST</strong> opcode as we’ll see in the Disassembly section.</p></li></ul></li></ul><p>If you are interested in how Solidity boils down to EVM code, reading through Decompilation will be a treat. There are many neat things to be exposed to such as the dispatch table routing your function calls to the specific code location and looking at many behind-the-scenes protective measures Solidity employs to guard your functions against dirty bits and receiving ether it shouldn’t be expecting.</p><p>Before we dive into the Decompilation, let’s become familiar with Disassembly.</p><div class="captioned-image-container"><figure><a class="image-link image2" target="_blank" rel="nofollow" href="https://cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fc6443e33-8652-4af7-b18b-7e4588f02536_1015x625.png"><picture><source type="image/webp" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fc6443e33-8652-4af7-b18b-7e4588f02536_1015x625.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fc6443e33-8652-4af7-b18b-7e4588f02536_1015x625.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fc6443e33-8652-4af7-b18b-7e4588f02536_1015x625.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fc6443e33-8652-4af7-b18b-7e4588f02536_1015x625.png 1456w" sizes="100vw"><img src="https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/c6443e33-8652-4af7-b18b-7e4588f02536_1015x625.png" width="1015" height="625" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/c6443e33-8652-4af7-b18b-7e4588f02536_1015x625.png","fullscreen":null,"imageSize":null,"height":625,"width":1015,"resizeWidth":null,"bytes":118859,"alt":null,"title":null,"type":"image/png","href":null}" class="sizing-normal" alt="" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fc6443e33-8652-4af7-b18b-7e4588f02536_1015x625.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fc6443e33-8652-4af7-b18b-7e4588f02536_1015x625.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fc6443e33-8652-4af7-b18b-7e4588f02536_1015x625.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fc6443e33-8652-4af7-b18b-7e4588f02536_1015x625.png 1456w" sizes="100vw"></picture></a><figcaption class="image-caption">Specifics of Disassembly</figcaption></figure></div><p>There are 4 key components to make note of:</p><ol><li><p>The labeling system</p><ol><li><p>label_XXXX refers to the beginning of a block of code. </p></li><li><p>Each block is designed to be a self-contained control flow. If you enter it, you don’t leave until you reach the ending opcode. Labels are separated according to this rule.</p></li></ol></li><li><p>The program counter</p><ol><li><p>This section refers to the position of each opcode within the overall runtime code. This is a running tally where each opcode sits in respect to an offset from the first byte.</p></li></ol></li><li><p>The opcode byte</p><ol><li><p>Each EVM opcode has a designated byte. These refer to specific actions that the EVM performs according to the value of the byte.</p></li><li><p><a href="https://www.evm.codes">evm.codes</a> is a fantastic online resource to learn more about each opcode</p></li></ol></li><li><p>Annotated opcode bytes</p><ol><li><p>This section adds annotated names to the opcode bytes and includes all <strong>PUSH</strong>’d values</p></li></ol></li></ol><p>The disassembly is a section that we will be searching through a lot in this challenge. Ctrl+F is your friend to search for common patterns, and we will use it strategically throughout our exploratory phase.</p><h5>A Brief Recap</h5><p>To recap what we’ve covered so far, we have:</p><ul><li><p>A localized Challenge setup</p></li><li><p>A Foundry test suite to quickly run our ideas</p></li><li><p>An online decompiler (<a href="https://ethervm.io/">ethervm</a>) to read through the bytecode</p></li><li><p>An online Opcode resource (<a href="https://www.evm.codes">evm.codes</a>) to learn more of how the stack, memory, and storage are utilized throughout the contract</p></li></ul><p>As a forewarning, the following content regarding the solution is going to be <em>dense</em>. The challenge requires a deep understanding of managing the <strong>EVM stack</strong> & finding exploitable <strong>label chunks</strong>, and I will do my best to explain it. I recommend a fellow writer’s <a href="https://noxx.substack.com/p/evm-deep-dives-the-path-to-shadowy?s=r">EVM Deep Dives</a> series if you find yourself needing a greater explanation of these concepts than I provide.</p><div class="embedded-post-wrap" data-attrs="{"id":49404796,"url":"https://noxx.substack.com/p/evm-deep-dives-the-path-to-shadowy","publication_id":774751,"publication_name":"noxx","publication_logo_url":null,"title":"EVM Deep Dives: The Path to Shadowy Super Coder 🥷 💻 - Part 1 ","truncated_body_text":"First principles thinking is a term we often hear. It focuses on deeply understanding the foundational concepts of a subject to enable better thinking in the design space of the components which are built on top. In the smart contract world, the “Ethereum Virtual Machine” along with its algorithms and data structures are the first principles. Solidity an…","date":"2022-02-27T18:51:08.348Z","like_count":26,"comment_count":1,"bylines":[{"id":80455042,"name":"noxx","photo_url":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/9d19b096-c3ee-486f-9538-e7809579e315_48x48.png","bio":"0x0000000000000000000000000000000000000000 to see here","profile_set_up_at":null,"publicationUsers":[{"id":711607,"user_id":80455042,"publication_id":774751,"role":"admin","public":true,"is_primary":false,"publication":{"id":774751,"name":"noxx","subdomain":"noxx","custom_domain":null,"custom_domain_optional":false,"hero_text":"EVM Technical Deep Dives","logo_url":null,"author_id":80455042,"theme_var_background_pop":"#EA410B","created_at":"2022-02-26T07:32:56.355Z","rss_website_url":null,"email_from_name":null,"copyright":"noxx","founding_plan_name":null,"community_enabled":true,"invite_only":false}}],"twitter_screen_name":"n0xxon","is_guest":false}],"utm_campaign":null}"><a class="embedded-post" native="true" href="https://noxx.substack.com/p/evm-deep-dives-the-path-to-shadowy?utm_source=substack&utm_campaign=post_embed&utm_medium=web"><div class="embedded-post-header"><span></span><span class="embedded-post-publication-name">noxx</span></div><div class="embedded-post-title">EVM Deep Dives: The Path to Shadowy Super Coder 🥷 💻 - Part 1 </div><div class="embedded-post-body">First principles thinking is a term we often hear. It focuses on deeply understanding the foundational concepts of a subject to enable better thinking in the design space of the components which are built on top. In the smart contract world, the “Ethereum Virtual Machine” along with its algorithms and data structures are the first principles. Solidity an…</div><span class="embedded-post-read-more">Read more</span><div class="embedded-post-meta">a month ago · 26 likes · 1 comment · noxx</div></a></div><p></p><h2>The Solution</h2><p>Since we are dealing with such an open-ended problem, I’d like to frame this section through the mindset of a CTF-solver, yet in the interest of length I will lightly reference attempted paths that don’t lead to interesting results.</p><p>These are pending questions we have at this point:</p><ul><li><p>Can we trust the ERC20 functions? Do they act as intended?</p><ul><li><p>After testing, we can trust these to function as intended.</p></li></ul></li><li><p>Are there any red flags 🚩 in the Decompilation or Disassembly?</p></li><li><p>What do the Unknown functions do?</p></li><li><p>How do we access + write to the owner() slot (slot 5)?</p></li><li><p>How do we send away the Eth?</p></li><li><p>How do we remove the balance of the ERC20 token?</p></li></ul><p></p><h4>Reviewing the Decompilation</h4><p>Our goal with reviewing the Decompilation is not to fully understand what the program is doing, but instead to see if we can find any red flags. A nice feature of ethervm is that it adds helpful comments to the Decompilation. A quick tip is to check if they’ve flagged any lines with <strong>Error</strong> comments. If we search the webpage for Error, we get 6 results.</p><div class="captioned-image-container"><figure><a class="image-link image2" target="_blank" rel="nofollow" href="https://cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F21d6d461-85f0-4b1f-83ea-7635fad09960_1032x296.png"><picture><source type="image/webp" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F21d6d461-85f0-4b1f-83ea-7635fad09960_1032x296.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F21d6d461-85f0-4b1f-83ea-7635fad09960_1032x296.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F21d6d461-85f0-4b1f-83ea-7635fad09960_1032x296.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F21d6d461-85f0-4b1f-83ea-7635fad09960_1032x296.png 1456w" sizes="100vw"><img src="https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/21d6d461-85f0-4b1f-83ea-7635fad09960_1032x296.png" width="1032" height="296" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/21d6d461-85f0-4b1f-83ea-7635fad09960_1032x296.png","fullscreen":null,"imageSize":null,"height":296,"width":1032,"resizeWidth":null,"bytes":54493,"alt":null,"title":null,"type":"image/png","href":null}" class="sizing-normal" alt="" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F21d6d461-85f0-4b1f-83ea-7635fad09960_1032x296.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F21d6d461-85f0-4b1f-83ea-7635fad09960_1032x296.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F21d6d461-85f0-4b1f-83ea-7635fad09960_1032x296.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F21d6d461-85f0-4b1f-83ea-7635fad09960_1032x296.png 1456w" sizes="100vw"></picture></a><figcaption class="image-caption">An Error inside buyTokens()!</figcaption></figure></div><p>The worst of the bunch is this line:</p><pre><code>// Error: Could not resolve jump destination!</code></pre><p>Essentially, if we can get to this position, we can jump to a dynamically found JUMPDEST. We need to investigate further to see if we can manipulate the calculation for this JUMP. Let’s follow the Disassembly starting at label_1CB2 to see how this is calculated:</p><div class="captioned-image-container"><figure><a class="image-link image2" target="_blank" rel="nofollow" href="https://cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9315e353-2f71-4f14-b0ca-ffc92e470df7_1066x247.png"><picture><source type="image/webp" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9315e353-2f71-4f14-b0ca-ffc92e470df7_1066x247.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9315e353-2f71-4f14-b0ca-ffc92e470df7_1066x247.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9315e353-2f71-4f14-b0ca-ffc92e470df7_1066x247.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9315e353-2f71-4f14-b0ca-ffc92e470df7_1066x247.png 1456w" sizes="100vw"><img src="https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/9315e353-2f71-4f14-b0ca-ffc92e470df7_1066x247.png" width="1066" height="247" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/9315e353-2f71-4f14-b0ca-ffc92e470df7_1066x247.png","fullscreen":null,"imageSize":null,"height":247,"width":1066,"resizeWidth":null,"bytes":51608,"alt":null,"title":null,"type":"image/png","href":null}" class="sizing-normal" alt="" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9315e353-2f71-4f14-b0ca-ffc92e470df7_1066x247.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9315e353-2f71-4f14-b0ca-ffc92e470df7_1066x247.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9315e353-2f71-4f14-b0ca-ffc92e470df7_1066x247.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9315e353-2f71-4f14-b0ca-ffc92e470df7_1066x247.png 1456w" sizes="100vw"></picture></a><figcaption class="image-caption">Label 1CB2, we immediately get jumped to label_1D0F if gas price < 200 gwei</figcaption></figure></div><p>After arriving to label_1CB2, we immediately get jumped to label_1D0F if we send the tx with gas price being less than 200 gwei.</p><div class="captioned-image-container"><figure><a class="image-link image2" target="_blank" rel="nofollow" href="https://cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F1b48b377-2bc1-486c-82ab-7619b98e2771_1053x711.png"><picture><source type="image/webp" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F1b48b377-2bc1-486c-82ab-7619b98e2771_1053x711.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F1b48b377-2bc1-486c-82ab-7619b98e2771_1053x711.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F1b48b377-2bc1-486c-82ab-7619b98e2771_1053x711.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F1b48b377-2bc1-486c-82ab-7619b98e2771_1053x711.png 1456w" sizes="100vw"><img src="https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/1b48b377-2bc1-486c-82ab-7619b98e2771_1053x711.png" width="1053" height="711" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/1b48b377-2bc1-486c-82ab-7619b98e2771_1053x711.png","fullscreen":null,"imageSize":null,"height":711,"width":1053,"resizeWidth":null,"bytes":100201,"alt":null,"title":null,"type":"image/png","href":null}" class="sizing-normal" alt="" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F1b48b377-2bc1-486c-82ab-7619b98e2771_1053x711.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F1b48b377-2bc1-486c-82ab-7619b98e2771_1053x711.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F1b48b377-2bc1-486c-82ab-7619b98e2771_1053x711.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F1b48b377-2bc1-486c-82ab-7619b98e2771_1053x711.png 1456w" sizes="100vw"></picture></a></figure></div><p>Greeting us in label_1D0F is a familiar comment letting us know that we get jumped here if our tx has a <200 gwei gas price. Notably, the end comment lets us know about the unconditional jump from the Error message! Let’s paste the full comment:</p><pre><code>// Block ends with unconditional jump to 0xffffffff & 0xffffffffffffffff & (0x1f51 * !(storage[0x0b] / 0x0100 ** 0x00) | storage[0x0b] / 0x0100 ** 0x00)</code></pre><p>To rephrase this in pseudocode:</p><pre><code>If (storage slot 0x0b is empty) {
jump to 0x1f51
}
else {
jump to location specified in storage slot 0x0b
}</code></pre><p>This is incredible! Taking over this storage slot with our jump location is the key to beginning this challenge, and is the namesake of the puzzle - Jump Oriented Programming (JOP) 🦘🦘🦘. We will bear witness to how powerful directing control flow can become.</p><h4>Storing values into 0x0b</h4><p>The EVM accesses storage locations using SLOAD, which takes in a value off the stack. We can search for <strong>PUSH1 0x0b</strong> to see the locations where this is accessed.</p><p>There are 2 locations:</p><ul><li><p>label_1D0F</p><ul><li><p>The location we just looked at. We know the value is only <em>read</em> from here.</p></li></ul></li><li><p>label_0A20</p><ul><li><p>This location uses an <strong>SSTORE</strong> to fill the slot!</p></li></ul></li></ul><div class="captioned-image-container"><figure><a class="image-link image2" target="_blank" rel="nofollow" href="https://cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fb35e6537-9365-4c80-8766-2a9043cb3c20_587x322.png"><picture><source type="image/webp" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fb35e6537-9365-4c80-8766-2a9043cb3c20_587x322.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fb35e6537-9365-4c80-8766-2a9043cb3c20_587x322.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fb35e6537-9365-4c80-8766-2a9043cb3c20_587x322.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fb35e6537-9365-4c80-8766-2a9043cb3c20_587x322.png 1456w" sizes="100vw"><img src="https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/b35e6537-9365-4c80-8766-2a9043cb3c20_587x322.png" width="587" height="322" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/b35e6537-9365-4c80-8766-2a9043cb3c20_587x322.png","fullscreen":null,"imageSize":null,"height":322,"width":587,"resizeWidth":null,"bytes":47010,"alt":null,"title":null,"type":"image/png","href":null}" class="sizing-normal" alt="" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fb35e6537-9365-4c80-8766-2a9043cb3c20_587x322.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fb35e6537-9365-4c80-8766-2a9043cb3c20_587x322.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fb35e6537-9365-4c80-8766-2a9043cb3c20_587x322.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fb35e6537-9365-4c80-8766-2a9043cb3c20_587x322.png 1456w" sizes="100vw"></picture></a><figcaption class="image-caption">Label 0A20 puts a value into storage at slot 0x0b</figcaption></figure></div><p>We need to see how we get into label_0A20, and if we can manipulate the value sent into slot 0x0b. This requires <em>a lot</em> of backtracing from label to label. For brevity’s sake, we go backwards through the incoming jumps and remember any conditions we need to pass:</p><p>label_0A20 → 0365 → 034B →0334 → 00CC → 00C1 → 001D → 000C</p><ul><li><p>msg.data >= 36 bytes</p></li><li><p>msg.value == 0</p></li><li><p>msg.data[0:4] == 0x27f83350</p></li></ul><p>Simple enough! Let’s put together a test transaction and use the <strong>load()</strong> cheatcode to see what happens.</p><div class="captioned-image-container"><figure><a class="image-link image2" target="_blank" rel="nofollow" href="https://cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F2fbfb501-7f7b-466d-a85f-f74900db9fb7_958x89.png"><picture><source type="image/webp" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F2fbfb501-7f7b-466d-a85f-f74900db9fb7_958x89.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F2fbfb501-7f7b-466d-a85f-f74900db9fb7_958x89.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F2fbfb501-7f7b-466d-a85f-f74900db9fb7_958x89.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F2fbfb501-7f7b-466d-a85f-f74900db9fb7_958x89.png 1456w" sizes="100vw"><img src="https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/2fbfb501-7f7b-466d-a85f-f74900db9fb7_958x89.png" width="958" height="89" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/2fbfb501-7f7b-466d-a85f-f74900db9fb7_958x89.png","fullscreen":null,"imageSize":null,"height":89,"width":958,"resizeWidth":null,"bytes":14728,"alt":null,"title":null,"type":"image/png","href":null}" class="sizing-normal" alt="" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F2fbfb501-7f7b-466d-a85f-f74900db9fb7_958x89.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F2fbfb501-7f7b-466d-a85f-f74900db9fb7_958x89.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F2fbfb501-7f7b-466d-a85f-f74900db9fb7_958x89.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F2fbfb501-7f7b-466d-a85f-f74900db9fb7_958x89.png 1456w" sizes="100vw"></picture></a><figcaption class="image-caption">Our function in myExploit sending in a c0dec0dec0de… payload</figcaption></figure></div><p>I’ve put a recognizable chunk of data (c0dec0dec0de…) to act as my payload. Now we add in a testing function to call this function and view the storage slot afterwards:</p><div class="captioned-image-container"><figure><a class="image-link image2" target="_blank" rel="nofollow" href="https://cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fb6fd5473-796d-4bb7-9185-b4df6d815daa_992x148.png"><picture><source type="image/webp" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fb6fd5473-796d-4bb7-9185-b4df6d815daa_992x148.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fb6fd5473-796d-4bb7-9185-b4df6d815daa_992x148.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fb6fd5473-796d-4bb7-9185-b4df6d815daa_992x148.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fb6fd5473-796d-4bb7-9185-b4df6d815daa_992x148.png 1456w" sizes="100vw"><img src="https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/b6fd5473-796d-4bb7-9185-b4df6d815daa_992x148.png" width="992" height="148" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/b6fd5473-796d-4bb7-9185-b4df6d815daa_992x148.png","fullscreen":null,"imageSize":null,"height":148,"width":992,"resizeWidth":null,"bytes":24188,"alt":null,"title":null,"type":"image/png","href":null}" class="sizing-normal" alt="" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fb6fd5473-796d-4bb7-9185-b4df6d815daa_992x148.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fb6fd5473-796d-4bb7-9185-b4df6d815daa_992x148.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fb6fd5473-796d-4bb7-9185-b4df6d815daa_992x148.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fb6fd5473-796d-4bb7-9185-b4df6d815daa_992x148.png 1456w" sizes="100vw"></picture></a><figcaption class="image-caption">Our testing function to call storeInSlot0x0b() and see how the slot reacts</figcaption></figure></div><p>We run <strong>forge test -vvvvv -m testViewSlot0x0b</strong>:</p><div class="captioned-image-container"><figure><a class="image-link image2" target="_blank" rel="nofollow" href="https://cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F81bc9431-9519-48c8-ad49-a4ea208d6a5a_1293x270.png"><picture><source type="image/webp" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F81bc9431-9519-48c8-ad49-a4ea208d6a5a_1293x270.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F81bc9431-9519-48c8-ad49-a4ea208d6a5a_1293x270.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F81bc9431-9519-48c8-ad49-a4ea208d6a5a_1293x270.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F81bc9431-9519-48c8-ad49-a4ea208d6a5a_1293x270.png 1456w" sizes="100vw"><img src="https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/81bc9431-9519-48c8-ad49-a4ea208d6a5a_1293x270.png" width="1200" height="250.5800464037123" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/81bc9431-9519-48c8-ad49-a4ea208d6a5a_1293x270.png","fullscreen":false,"imageSize":"large","height":270,"width":1293,"resizeWidth":1200,"bytes":65186,"alt":null,"title":null,"type":"image/png","href":null}" class="sizing-large" alt="" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F81bc9431-9519-48c8-ad49-a4ea208d6a5a_1293x270.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F81bc9431-9519-48c8-ad49-a4ea208d6a5a_1293x270.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F81bc9431-9519-48c8-ad49-a4ea208d6a5a_1293x270.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F81bc9431-9519-48c8-ad49-a4ea208d6a5a_1293x270.png 1456w" sizes="100vw"></picture></a><figcaption class="image-caption">Our payload is stored in slot 0x0b!</figcaption></figure></div><p>We see that our payload is now stored in slot 0x0b! We could have determined this similarly by entering <strong>—debug</strong> mode and watching how the stack item is formulated, but this way is just as simple. It’s also nice to have a test handy if we run into later troubleshooting issues.</p><p>Now that we have a way to store a value into the slot, we’ll quickly double check that we can access this JUMP through the <strong>buyTokens()</strong> path we saw earlier. Let’s make a new function in myExploit and a new testing function to call it.</p><div class="captioned-image-container"><figure><a class="image-link image2" target="_blank" rel="nofollow" href="https://cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F507250c3-a3df-4b2c-a8ab-113799bd5205_432x91.png"><picture><source type="image/webp" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F507250c3-a3df-4b2c-a8ab-113799bd5205_432x91.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F507250c3-a3df-4b2c-a8ab-113799bd5205_432x91.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F507250c3-a3df-4b2c-a8ab-113799bd5205_432x91.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F507250c3-a3df-4b2c-a8ab-113799bd5205_432x91.png 1456w" sizes="100vw"><img src="https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/507250c3-a3df-4b2c-a8ab-113799bd5205_432x91.png" width="432" height="91" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/507250c3-a3df-4b2c-a8ab-113799bd5205_432x91.png","fullscreen":null,"imageSize":null,"height":91,"width":432,"resizeWidth":null,"bytes":11610,"alt":null,"title":null,"type":"image/png","href":null}" class="sizing-normal" alt="" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F507250c3-a3df-4b2c-a8ab-113799bd5205_432x91.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F507250c3-a3df-4b2c-a8ab-113799bd5205_432x91.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F507250c3-a3df-4b2c-a8ab-113799bd5205_432x91.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F507250c3-a3df-4b2c-a8ab-113799bd5205_432x91.png 1456w" sizes="100vw"></picture></a><figcaption class="image-caption">Function to jump to the location in slot 0x0b</figcaption></figure></div><div class="captioned-image-container"><figure><a class="image-link image2" target="_blank" rel="nofollow" href="https://cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F576c4277-3081-4ba5-8e01-16566b3cf017_379x109.png"><picture><source type="image/webp" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F576c4277-3081-4ba5-8e01-16566b3cf017_379x109.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F576c4277-3081-4ba5-8e01-16566b3cf017_379x109.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F576c4277-3081-4ba5-8e01-16566b3cf017_379x109.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F576c4277-3081-4ba5-8e01-16566b3cf017_379x109.png 1456w" sizes="100vw"><img src="https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/576c4277-3081-4ba5-8e01-16566b3cf017_379x109.png" width="379" height="109" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/576c4277-3081-4ba5-8e01-16566b3cf017_379x109.png","fullscreen":null,"imageSize":null,"height":109,"width":379,"resizeWidth":null,"bytes":11144,"alt":null,"title":null,"type":"image/png","href":null}" class="sizing-normal" alt="" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F576c4277-3081-4ba5-8e01-16566b3cf017_379x109.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F576c4277-3081-4ba5-8e01-16566b3cf017_379x109.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F576c4277-3081-4ba5-8e01-16566b3cf017_379x109.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F576c4277-3081-4ba5-8e01-16566b3cf017_379x109.png 1456w" sizes="100vw"></picture></a><figcaption class="image-caption">Testing function</figcaption></figure></div><p>This time we run with <strong>forge test —debug testJumpFromBuyTokens</strong>. This places us into the debugger, where we can view the step-by-step opcodes.</p><p></p><div class="captioned-image-container"><figure><a class="image-link image2" target="_blank" rel="nofollow" href="https://cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F89be5af1-f40d-442c-878b-c324790b002b_1191x419.png"><picture><source type="image/webp" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F89be5af1-f40d-442c-878b-c324790b002b_1191x419.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F89be5af1-f40d-442c-878b-c324790b002b_1191x419.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F89be5af1-f40d-442c-878b-c324790b002b_1191x419.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F89be5af1-f40d-442c-878b-c324790b002b_1191x419.png 1456w" sizes="100vw"><img src="https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/89be5af1-f40d-442c-878b-c324790b002b_1191x419.png" width="1200" height="422.1662468513854" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/89be5af1-f40d-442c-878b-c324790b002b_1191x419.png","fullscreen":false,"imageSize":"large","height":419,"width":1191,"resizeWidth":1200,"bytes":33567,"alt":null,"title":null,"type":"image/png","href":null}" class="sizing-large" alt="" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F89be5af1-f40d-442c-878b-c324790b002b_1191x419.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F89be5af1-f40d-442c-878b-c324790b002b_1191x419.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F89be5af1-f40d-442c-878b-c324790b002b_1191x419.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F89be5af1-f40d-442c-878b-c324790b002b_1191x419.png 1456w" sizes="100vw"></picture></a><figcaption class="image-caption">What a beautiful debugger it is!</figcaption></figure></div><p>To save you the trouble, I advanced in time through the opcodes to the position of the relevant <strong>SLOAD</strong> within <strong>label_1D0F</strong> that we found earlier. Here we see that directly after the <strong>SLOAD</strong>, our c0dec0dec0de… payload has made it onto the stack. Perfect! In the future we’ll be placing a legitimate <strong>JUMPDEST</strong> into slot 0x0b rather than the recognizable payload.</p><h4>How Do We Use It?</h4><p>Despite making undeniable progress, this finding does not directly progress our goals. Let’s keep in mind that we can start <strong>JUMP</strong>ing to locations and begin looking for ways to abuse that.</p><h4>Investigating the Unknown functions</h4><p>Now that we’ve seen the first unknown function <strong>0x27f83350</strong> corresponded to a unique opportunity, it makes sense to check the other one! We’re going to find the entry point of <strong>0x84e2b7f6</strong>. </p><div class="captioned-image-container"><figure><a class="image-link image2" target="_blank" rel="nofollow" href="https://cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F33a68166-61d8-4c5e-8656-9b7668ae84c7_559x331.png"><picture><source type="image/webp" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F33a68166-61d8-4c5e-8656-9b7668ae84c7_559x331.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F33a68166-61d8-4c5e-8656-9b7668ae84c7_559x331.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F33a68166-61d8-4c5e-8656-9b7668ae84c7_559x331.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F33a68166-61d8-4c5e-8656-9b7668ae84c7_559x331.png 1456w" sizes="100vw"><img src="https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/33a68166-61d8-4c5e-8656-9b7668ae84c7_559x331.png" width="559" height="331" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/33a68166-61d8-4c5e-8656-9b7668ae84c7_559x331.png","fullscreen":null,"imageSize":null,"height":331,"width":559,"resizeWidth":null,"bytes":53802,"alt":null,"title":null,"type":"image/png","href":null}" class="sizing-normal" alt="" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F33a68166-61d8-4c5e-8656-9b7668ae84c7_559x331.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F33a68166-61d8-4c5e-8656-9b7668ae84c7_559x331.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F33a68166-61d8-4c5e-8656-9b7668ae84c7_559x331.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F33a68166-61d8-4c5e-8656-9b7668ae84c7_559x331.png 1456w" sizes="100vw"></picture></a><figcaption class="image-caption">The dispatch table sends us to label_054D</figcaption></figure></div><div class="captioned-image-container"><figure><a class="image-link image2" target="_blank" rel="nofollow" href="https://cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F2bf5bf1f-7bda-4529-a81a-a5e00e984819_848x258.png"><picture><source type="image/webp" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F2bf5bf1f-7bda-4529-a81a-a5e00e984819_848x258.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F2bf5bf1f-7bda-4529-a81a-a5e00e984819_848x258.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F2bf5bf1f-7bda-4529-a81a-a5e00e984819_848x258.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F2bf5bf1f-7bda-4529-a81a-a5e00e984819_848x258.png 1456w" sizes="100vw"><img src="https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/2bf5bf1f-7bda-4529-a81a-a5e00e984819_848x258.png" width="848" height="258" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/2bf5bf1f-7bda-4529-a81a-a5e00e984819_848x258.png","fullscreen":null,"imageSize":null,"height":258,"width":848,"resizeWidth":null,"bytes":35473,"alt":null,"title":null,"type":"image/png","href":null}" class="sizing-normal" alt="" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F2bf5bf1f-7bda-4529-a81a-a5e00e984819_848x258.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F2bf5bf1f-7bda-4529-a81a-a5e00e984819_848x258.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F2bf5bf1f-7bda-4529-a81a-a5e00e984819_848x258.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F2bf5bf1f-7bda-4529-a81a-a5e00e984819_848x258.png 1456w" sizes="100vw"></picture></a><figcaption class="image-caption">label_054D sends us to label_19FC</figcaption></figure></div><div class="captioned-image-container"><figure><a class="image-link image2" target="_blank" rel="nofollow" href="https://cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fdbc1f87e-3fb0-4c46-a9d1-932abfed31a9_747x217.png"><picture><source type="image/webp" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fdbc1f87e-3fb0-4c46-a9d1-932abfed31a9_747x217.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fdbc1f87e-3fb0-4c46-a9d1-932abfed31a9_747x217.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fdbc1f87e-3fb0-4c46-a9d1-932abfed31a9_747x217.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fdbc1f87e-3fb0-4c46-a9d1-932abfed31a9_747x217.png 1456w" sizes="100vw"><img src="https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/dbc1f87e-3fb0-4c46-a9d1-932abfed31a9_747x217.png" width="747" height="217" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/dbc1f87e-3fb0-4c46-a9d1-932abfed31a9_747x217.png","fullscreen":null,"imageSize":null,"height":217,"width":747,"resizeWidth":null,"bytes":null,"alt":"","title":null,"type":null,"href":null}" class="sizing-normal" alt="" title="" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fdbc1f87e-3fb0-4c46-a9d1-932abfed31a9_747x217.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fdbc1f87e-3fb0-4c46-a9d1-932abfed31a9_747x217.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fdbc1f87e-3fb0-4c46-a9d1-932abfed31a9_747x217.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fdbc1f87e-3fb0-4c46-a9d1-932abfed31a9_747x217.png 1456w" sizes="100vw"></picture></a><figcaption class="image-caption">label_19FC refers to our msg.data</figcaption></figure></div><p>After a quick search, we see that it leads us from <strong>0x84e2b7f6 → label_054D → label_19FC</strong>.</p><p>Inside <strong>label_19FC</strong> is a promising discovery! It directly looks at the <strong>msg.data</strong> that we can provide to <strong>buyTokens()</strong>. Side note: Typically it is not allowable to provide data when the function asks for none, but in Solidity versions <0.8.x where abicoder v1 is used, nothing is stopping you!</p><h5>Let’s Dig Deeper Into This</h5><p>Now is the appropriate time to dive back into the Disassembly to see how this code manifests. We head to <strong>label_19FC</strong> and pay attention to <strong>Inputs</strong> and <strong>Outputs</strong></p><div class="captioned-image-container"><figure><a class="image-link image2" target="_blank" rel="nofollow" href="https://cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9f61267a-d193-494c-91eb-ddda0204d3f2_742x244.png"><picture><source type="image/webp" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9f61267a-d193-494c-91eb-ddda0204d3f2_742x244.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9f61267a-d193-494c-91eb-ddda0204d3f2_742x244.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9f61267a-d193-494c-91eb-ddda0204d3f2_742x244.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9f61267a-d193-494c-91eb-ddda0204d3f2_742x244.png 1456w" sizes="100vw"><img src="https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/9f61267a-d193-494c-91eb-ddda0204d3f2_742x244.png" width="742" height="244" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/9f61267a-d193-494c-91eb-ddda0204d3f2_742x244.png","fullscreen":null,"imageSize":null,"height":244,"width":742,"resizeWidth":null,"bytes":51251,"alt":null,"title":null,"type":"image/png","href":null}" class="sizing-normal" alt="" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9f61267a-d193-494c-91eb-ddda0204d3f2_742x244.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9f61267a-d193-494c-91eb-ddda0204d3f2_742x244.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9f61267a-d193-494c-91eb-ddda0204d3f2_742x244.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9f61267a-d193-494c-91eb-ddda0204d3f2_742x244.png 1456w" sizes="100vw"></picture></a><figcaption class="image-caption">label_19FC Inputs</figcaption></figure></div><div class="captioned-image-container"><figure><a class="image-link image2" target="_blank" rel="nofollow" href="https://cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Ffaa3ad8d-1c66-4dd4-b989-5bcb600d173a_1045x300.png"><picture><source type="image/webp" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Ffaa3ad8d-1c66-4dd4-b989-5bcb600d173a_1045x300.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Ffaa3ad8d-1c66-4dd4-b989-5bcb600d173a_1045x300.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Ffaa3ad8d-1c66-4dd4-b989-5bcb600d173a_1045x300.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Ffaa3ad8d-1c66-4dd4-b989-5bcb600d173a_1045x300.png 1456w" sizes="100vw"><img src="https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/faa3ad8d-1c66-4dd4-b989-5bcb600d173a_1045x300.png" width="1045" height="300" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/faa3ad8d-1c66-4dd4-b989-5bcb600d173a_1045x300.png","fullscreen":null,"imageSize":null,"height":300,"width":1045,"resizeWidth":null,"bytes":78744,"alt":null,"title":null,"type":"image/png","href":null}" class="sizing-normal" alt="" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Ffaa3ad8d-1c66-4dd4-b989-5bcb600d173a_1045x300.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Ffaa3ad8d-1c66-4dd4-b989-5bcb600d173a_1045x300.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Ffaa3ad8d-1c66-4dd4-b989-5bcb600d173a_1045x300.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Ffaa3ad8d-1c66-4dd4-b989-5bcb600d173a_1045x300.png 1456w" sizes="100vw"></picture></a><figcaption class="image-caption">label_19FC Outputs</figcaption></figure></div><p>Notably, the outputs are very promising. We can see that the function is parsing our <strong>msg.data</strong> into bytes32 sized chunks, and placing them onto the stack. I’ll be talking about these 4 stack values a lot, so I’m going to begin referring to these with a simpler rename:</p><pre><code>word1 = stack[4]
word2 = stack[5]
word3 = stack[6]
word4 = stack[7]</code></pre><p>This would be a huge discovery if it lets us use one of these stack values to <strong>JUMP</strong> to another location. Let’s continue following the trail into <strong>label_1A99</strong>, pay attention to any restrictions, and see if we can control an ending <strong>JUMP</strong>.</p><p>Tracing through:</p><p><strong>label_19FC → 1A99 → 1B11 → 1BAA →1BBA</strong></p><p>Translating relevant restrictions to pseudocode:</p><pre><code>19FC:
if (word2 > 0) {
jump to label_1A99
} else revert;
1A99:
if (word3 > 0) {
jump to label_1B11
} else revert;
1B11:
if (word4 < 27) {
word4 += 27
jump to label_1BBA
} else jump to label_1BBA
1BBA:
jump to stack item underneath our four words</code></pre><p>We can see that there are some basic restrictions based on our calldata input, and it looks like we can potentially control the final jump location? Overall it’s hard to grasp the big picture of what is happening here, so let’s use Foundry’s debugger to get a better view. (I highly recommend following along through the Disassembly + Debugger to familiarize yourself with these tools! My repo has each of these functions already set up for you!)</p><p>First, we need to store <strong>19FC</strong> into that slot 0x0b that we got excited about previously. Next, I’m going to write a payload that lets us watch what is going on inside 19FC with some recognizable values. Remember, we enter through <strong>buyTokens()</strong> to <strong>JUMP</strong> using the 0x0b slot.</p><div class="captioned-image-container"><figure><a class="image-link image2" target="_blank" rel="nofollow" href="https://cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F60ca8027-3eef-44b9-96d8-3021b798520e_938x330.png"><picture><source type="image/webp" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F60ca8027-3eef-44b9-96d8-3021b798520e_938x330.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F60ca8027-3eef-44b9-96d8-3021b798520e_938x330.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F60ca8027-3eef-44b9-96d8-3021b798520e_938x330.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F60ca8027-3eef-44b9-96d8-3021b798520e_938x330.png 1456w" sizes="100vw"><img src="https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/60ca8027-3eef-44b9-96d8-3021b798520e_938x330.png" width="938" height="330" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/60ca8027-3eef-44b9-96d8-3021b798520e_938x330.png","fullscreen":null,"imageSize":null,"height":330,"width":938,"resizeWidth":null,"bytes":56320,"alt":null,"title":null,"type":"image/png","href":null}" class="sizing-normal" alt="" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F60ca8027-3eef-44b9-96d8-3021b798520e_938x330.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F60ca8027-3eef-44b9-96d8-3021b798520e_938x330.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F60ca8027-3eef-44b9-96d8-3021b798520e_938x330.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F60ca8027-3eef-44b9-96d8-3021b798520e_938x330.png 1456w" sizes="100vw"></picture></a><figcaption class="image-caption">Our two functions, step1() and explore19FC()</figcaption></figure></div><div class="captioned-image-container"><figure><a class="image-link image2" target="_blank" rel="nofollow" href="https://cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F73d3caf7-0a00-4328-97a0-c47394475c89_336x110.png"><picture><source type="image/webp" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F73d3caf7-0a00-4328-97a0-c47394475c89_336x110.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F73d3caf7-0a00-4328-97a0-c47394475c89_336x110.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F73d3caf7-0a00-4328-97a0-c47394475c89_336x110.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F73d3caf7-0a00-4328-97a0-c47394475c89_336x110.png 1456w" sizes="100vw"><img src="https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/73d3caf7-0a00-4328-97a0-c47394475c89_336x110.png" width="336" height="110" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/73d3caf7-0a00-4328-97a0-c47394475c89_336x110.png","fullscreen":null,"imageSize":null,"height":110,"width":336,"resizeWidth":null,"bytes":9427,"alt":null,"title":null,"type":"image/png","href":null}" class="sizing-normal" alt="" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F73d3caf7-0a00-4328-97a0-c47394475c89_336x110.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F73d3caf7-0a00-4328-97a0-c47394475c89_336x110.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F73d3caf7-0a00-4328-97a0-c47394475c89_336x110.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F73d3caf7-0a00-4328-97a0-c47394475c89_336x110.png 1456w" sizes="100vw"></picture></a><figcaption class="image-caption">Our testing function, which runs both</figcaption></figure></div><p>I’ve crafted calldata inside <strong>explore19FC()</strong> that resembles this layout:</p><pre><code>0xd0febe4c // Function selector for buyTokens()
0000....0001 // word1
0000....0002 // word2
0000....0003 // word3
0000....0004 // word4</code></pre><p>Now, we can run our testing function <strong>testExplore19FC()</strong> using:</p><p> <strong>forge test —debug testExplore19FC</strong></p><p>For this debugging session, we only care about seeing how the <strong>explore19FC()</strong> function works, so let’s fast forward through the transaction until we get there. Use the <strong>capital C</strong> hotkey to advance forward in the calls until the you see the challengeAddress (<strong>0x1276…e134</strong>) come up for the <em>second </em>time. (Our first time calling the challenge address was for the placement of 19FC into the 0x0b slot.)</p><div class="captioned-image-container"><figure><a class="image-link image2" target="_blank" rel="nofollow" href="https://cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fa5c0eda7-f56b-4842-abbd-8225f34d6fa0_863x634.png"><picture><source type="image/webp" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fa5c0eda7-f56b-4842-abbd-8225f34d6fa0_863x634.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fa5c0eda7-f56b-4842-abbd-8225f34d6fa0_863x634.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fa5c0eda7-f56b-4842-abbd-8225f34d6fa0_863x634.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fa5c0eda7-f56b-4842-abbd-8225f34d6fa0_863x634.png 1456w" sizes="100vw"><img src="https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/a5c0eda7-f56b-4842-abbd-8225f34d6fa0_863x634.png" width="863" height="634" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/a5c0eda7-f56b-4842-abbd-8225f34d6fa0_863x634.png","fullscreen":null,"imageSize":null,"height":634,"width":863,"resizeWidth":null,"bytes":31922,"alt":null,"title":null,"type":"image/png","href":null}" class="sizing-normal" alt="" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fa5c0eda7-f56b-4842-abbd-8225f34d6fa0_863x634.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fa5c0eda7-f56b-4842-abbd-8225f34d6fa0_863x634.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fa5c0eda7-f56b-4842-abbd-8225f34d6fa0_863x634.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fa5c0eda7-f56b-4842-abbd-8225f34d6fa0_863x634.png 1456w" sizes="100vw"></picture></a><figcaption class="image-caption">The second time this comes up, you’re ready to follow along!</figcaption></figure></div><p>Here we can start using the arrow keys to navigate further into the call, and we’d like to collect ourselves onto the first occurence of <strong>19FC:</strong></p><div class="captioned-image-container"><figure><a class="image-link image2" target="_blank" rel="nofollow" href="https://cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fc3dfe473-2c07-4b4c-9969-287d5c4fb959_2345x408.png"><picture><source type="image/webp" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fc3dfe473-2c07-4b4c-9969-287d5c4fb959_2345x408.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fc3dfe473-2c07-4b4c-9969-287d5c4fb959_2345x408.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fc3dfe473-2c07-4b4c-9969-287d5c4fb959_2345x408.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fc3dfe473-2c07-4b4c-9969-287d5c4fb959_2345x408.png 1456w" sizes="100vw"><img src="https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/c3dfe473-2c07-4b4c-9969-287d5c4fb959_2345x408.png" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/c3dfe473-2c07-4b4c-9969-287d5c4fb959_2345x408.png","fullscreen":false,"imageSize":"full","height":253,"width":1456,"resizeWidth":null,"bytes":55486,"alt":null,"title":null,"type":"image/png","href":null}" class="sizing-fullscreen" alt="" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fc3dfe473-2c07-4b4c-9969-287d5c4fb959_2345x408.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fc3dfe473-2c07-4b4c-9969-287d5c4fb959_2345x408.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fc3dfe473-2c07-4b4c-9969-287d5c4fb959_2345x408.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fc3dfe473-2c07-4b4c-9969-287d5c4fb959_2345x408.png 1456w" sizes="100vw"></picture></a><figcaption class="image-caption">We collect ourselves on the first occurence of 19FC</figcaption></figure></div><p>I highly recommend turning <strong>stack labels </strong>on using the letter <strong>t </strong>hotkey, as it’ll help you parse what is occuring on the stack as we dive through the opcodes. If you had a keen eye, you’d notice that <strong>CALLVALUE </strong>was placed onto the top value of the stack before jumping into <strong>19FC</strong>. Keep this in mind and watch closely how it is used throughout the following steps.</p><p>If we keep going, we begin seeing our recognizable <strong>wordX</strong> values! </p><div class="captioned-image-container"><figure><a class="image-link image2" target="_blank" rel="nofollow" href="https://cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9a9a9e21-6fa7-4b7c-b451-5cffb706de79_2350x414.png"><picture><source type="image/webp" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9a9a9e21-6fa7-4b7c-b451-5cffb706de79_2350x414.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9a9a9e21-6fa7-4b7c-b451-5cffb706de79_2350x414.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9a9a9e21-6fa7-4b7c-b451-5cffb706de79_2350x414.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9a9a9e21-6fa7-4b7c-b451-5cffb706de79_2350x414.png 1456w" sizes="100vw"><img src="https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/9a9a9e21-6fa7-4b7c-b451-5cffb706de79_2350x414.png" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/9a9a9e21-6fa7-4b7c-b451-5cffb706de79_2350x414.png","fullscreen":false,"imageSize":"full","height":257,"width":1456,"resizeWidth":null,"bytes":57756,"alt":null,"title":null,"type":"image/png","href":null}" class="sizing-fullscreen" alt="" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9a9a9e21-6fa7-4b7c-b451-5cffb706de79_2350x414.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9a9a9e21-6fa7-4b7c-b451-5cffb706de79_2350x414.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9a9a9e21-6fa7-4b7c-b451-5cffb706de79_2350x414.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9a9a9e21-6fa7-4b7c-b451-5cffb706de79_2350x414.png 1456w" sizes="100vw"></picture></a><figcaption class="image-caption">Our words are getting placed onto the stack!</figcaption></figure></div><p>Continue following along until <strong>program counter</strong> <strong>1bd0</strong>. Here we need to make some notes:</p><div class="captioned-image-container"><figure><a class="image-link image2" target="_blank" rel="nofollow" href="https://cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fffeac72f-a2a7-429c-9eee-fed7bbdc8058_1487x558.png"><picture><source type="image/webp" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fffeac72f-a2a7-429c-9eee-fed7bbdc8058_1487x558.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fffeac72f-a2a7-429c-9eee-fed7bbdc8058_1487x558.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fffeac72f-a2a7-429c-9eee-fed7bbdc8058_1487x558.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fffeac72f-a2a7-429c-9eee-fed7bbdc8058_1487x558.png 1456w" sizes="100vw"><img src="https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/ffeac72f-a2a7-429c-9eee-fed7bbdc8058_1487x558.png" width="1456" height="546" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/ffeac72f-a2a7-429c-9eee-fed7bbdc8058_1487x558.png","fullscreen":null,"imageSize":null,"height":546,"width":1456,"resizeWidth":null,"bytes":53741,"alt":null,"title":null,"type":"image/png","href":null}" class="sizing-normal" alt="" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fffeac72f-a2a7-429c-9eee-fed7bbdc8058_1487x558.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fffeac72f-a2a7-429c-9eee-fed7bbdc8058_1487x558.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fffeac72f-a2a7-429c-9eee-fed7bbdc8058_1487x558.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fffeac72f-a2a7-429c-9eee-fed7bbdc8058_1487x558.png 1456w" sizes="100vw"></picture></a><figcaption class="image-caption">The most pivotal piece of the puzzle</figcaption></figure></div><p>Once the dust settles, we notice a few key takeaways:</p><ul><li><p>Our <strong>CALLVALUE</strong> was being used as an offset position inside our <strong>msg.data</strong></p></li></ul><ul><li><p><strong>Program Counter 1BD0</strong> let’s us <strong>JUMP</strong> to a stack item. In the ‘<strong>19FC</strong>’ picture a few figures above, <strong>1D39</strong> was the value directly underneath our <strong>CALLVALUE</strong> and here it is now at the top of the stack. </p></li><li><p><strong>1D39</strong> takes us immediately to another <strong>JUMP</strong>. The value is taken from <strong>word4</strong></p><ul><li><p>You can notice our inputted <strong>4</strong> got turned into a <strong>1f</strong> hex value. This is due to our earlier restriction that if <strong>word4 < 27, word4 += 27</strong>. <strong>1f == 31</strong></p></li></ul></li><li><p>The remaining ordering of the stack after the two <strong>JUMP</strong>s will be [<strong>word3</strong>, <strong>word2</strong>, <strong>word1</strong>] </p></li></ul><p>We love to see that we can place items on the stack and control an impending <strong>JUMP</strong> location. Let’s think about this… Is there anyway this can be abused? </p><h5>What if we re-enter label_19FC?</h5><p>To re-enter <strong>label_19FC</strong>, it would mean setting <strong>word4</strong> to <strong>19FC</strong>, and having <strong>word3</strong> act as our <strong>CALLVALUE</strong> for the next reiteration.</p><p>Let’s recraft our payload: </p><div class="captioned-image-container"><figure><a class="image-link image2" target="_blank" rel="nofollow" href="https://cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fccd12a1f-0490-42c2-96bd-019a104b21a5_1035x265.png"><picture><source type="image/webp" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fccd12a1f-0490-42c2-96bd-019a104b21a5_1035x265.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fccd12a1f-0490-42c2-96bd-019a104b21a5_1035x265.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fccd12a1f-0490-42c2-96bd-019a104b21a5_1035x265.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fccd12a1f-0490-42c2-96bd-019a104b21a5_1035x265.png 1456w" sizes="100vw"><img src="https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/ccd12a1f-0490-42c2-96bd-019a104b21a5_1035x265.png" width="1035" height="265" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/ccd12a1f-0490-42c2-96bd-019a104b21a5_1035x265.png","fullscreen":null,"imageSize":null,"height":265,"width":1035,"resizeWidth":null,"bytes":54905,"alt":null,"title":null,"type":"image/png","href":null}" class="sizing-normal" alt="" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fccd12a1f-0490-42c2-96bd-019a104b21a5_1035x265.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fccd12a1f-0490-42c2-96bd-019a104b21a5_1035x265.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fccd12a1f-0490-42c2-96bd-019a104b21a5_1035x265.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fccd12a1f-0490-42c2-96bd-019a104b21a5_1035x265.png 1456w" sizes="100vw"></picture></a><figcaption class="image-caption">Payload v2: bigger & better edition</figcaption></figure></div><ul><li><p>We set <strong>word3 = 0x84</strong>, as our next round of words will begin 132 characters deep into the calldata</p></li><li><p>We set <strong>word4 = 19FC</strong></p></li><li><p><strong>words5, 6, 7, 8</strong> are set to recognizable payloads</p></li></ul><p>Once again we run <strong>forge test —debug testExplore19FC</strong> and fast forward. Let’s reconvene again at program counter <strong>1BD0</strong>, but this time at the second iteration through:</p><div class="captioned-image-container"><figure><a class="image-link image2" target="_blank" rel="nofollow" href="https://cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fe326ef7b-c8a5-4370-8c85-dc2d2f8c12a9_1139x560.png"><picture><source type="image/webp" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fe326ef7b-c8a5-4370-8c85-dc2d2f8c12a9_1139x560.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fe326ef7b-c8a5-4370-8c85-dc2d2f8c12a9_1139x560.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fe326ef7b-c8a5-4370-8c85-dc2d2f8c12a9_1139x560.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fe326ef7b-c8a5-4370-8c85-dc2d2f8c12a9_1139x560.png 1456w" sizes="100vw"><img src="https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/e326ef7b-c8a5-4370-8c85-dc2d2f8c12a9_1139x560.png" width="1139" height="560" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/e326ef7b-c8a5-4370-8c85-dc2d2f8c12a9_1139x560.png","fullscreen":null,"imageSize":null,"height":560,"width":1139,"resizeWidth":null,"bytes":51382,"alt":null,"title":null,"type":"image/png","href":null}" class="sizing-normal" alt="" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fe326ef7b-c8a5-4370-8c85-dc2d2f8c12a9_1139x560.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fe326ef7b-c8a5-4370-8c85-dc2d2f8c12a9_1139x560.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fe326ef7b-c8a5-4370-8c85-dc2d2f8c12a9_1139x560.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fe326ef7b-c8a5-4370-8c85-dc2d2f8c12a9_1139x560.png 1456w" sizes="100vw"></picture></a><figcaption class="image-caption">Back at 1bd0, but this time with a larger stack!</figcaption></figure></div><p>We notice some takeaways again:</p><ul><li><p><strong>word2</strong> is the ending <strong>JUMP</strong> location for the <em>second </em>iteration</p></li><li><p><strong>word8</strong> is the <strong>calldata offset</strong> for the <em>third</em> iteration</p></li><li><p><strong>word7</strong> is going to be the ending <strong>JUMP</strong> location for the <em>third</em> iteration </p></li></ul><p>If you keep playing with this, a pattern emerges. We can continually add stack items and control full flow of the program using our inputted values. We only need to mind the restrictions that any values placed in Word1 or Word2 must be greater than 0, and any value placed in Word4 will inevitably be shifted to be above 27 if it is inputted as lower.</p><p>Compiling all of this information together, we’ll be using the following payload template to fully takeover control of the stack:</p><div class="captioned-image-container"><figure><a class="image-link image2" target="_blank" rel="nofollow" href="https://cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9a57665f-505a-4945-a9ab-3cf32e8a81b0_891x183.png"><picture><source type="image/webp" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9a57665f-505a-4945-a9ab-3cf32e8a81b0_891x183.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9a57665f-505a-4945-a9ab-3cf32e8a81b0_891x183.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9a57665f-505a-4945-a9ab-3cf32e8a81b0_891x183.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9a57665f-505a-4945-a9ab-3cf32e8a81b0_891x183.png 1456w" sizes="100vw"><img src="https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/9a57665f-505a-4945-a9ab-3cf32e8a81b0_891x183.png" width="891" height="183" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/9a57665f-505a-4945-a9ab-3cf32e8a81b0_891x183.png","fullscreen":null,"imageSize":null,"height":183,"width":891,"resizeWidth":null,"bytes":30553,"alt":null,"title":null,"type":"image/png","href":null}" class="sizing-normal" alt="" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9a57665f-505a-4945-a9ab-3cf32e8a81b0_891x183.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9a57665f-505a-4945-a9ab-3cf32e8a81b0_891x183.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9a57665f-505a-4945-a9ab-3cf32e8a81b0_891x183.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9a57665f-505a-4945-a9ab-3cf32e8a81b0_891x183.png 1456w" sizes="100vw"></picture></a><figcaption class="image-caption">Example Payload Template</figcaption></figure></div><p>Each one of the <strong>value</strong> entries will be safely placed onto the stack during the looping. Now that we can take complete control of the stack and <strong>JUMP</strong> to where we want from there, we can move onto fulfilling our win conditions!</p><h4>Changing the Owner</h4><p>We know the owner() variable is stored in slot 5. Let’s do a search for <strong>PUSH1 0x05 </strong>to see when it is accessed and stored to. In total there are 5 occurences.</p><div class="captioned-image-container"><figure><a class="image-link image2" target="_blank" rel="nofollow" href="https://cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fa742ebff-dbb1-4a78-9ed3-0fcd872fe5cc_750x527.png"><picture><source type="image/webp" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fa742ebff-dbb1-4a78-9ed3-0fcd872fe5cc_750x527.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fa742ebff-dbb1-4a78-9ed3-0fcd872fe5cc_750x527.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fa742ebff-dbb1-4a78-9ed3-0fcd872fe5cc_750x527.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fa742ebff-dbb1-4a78-9ed3-0fcd872fe5cc_750x527.png 1456w" sizes="100vw"><img src="https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/a742ebff-dbb1-4a78-9ed3-0fcd872fe5cc_750x527.png" width="750" height="527" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/a742ebff-dbb1-4a78-9ed3-0fcd872fe5cc_750x527.png","fullscreen":null,"imageSize":null,"height":527,"width":750,"resizeWidth":null,"bytes":72146,"alt":null,"title":null,"type":"image/png","href":null}" class="sizing-normal" alt="" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fa742ebff-dbb1-4a78-9ed3-0fcd872fe5cc_750x527.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fa742ebff-dbb1-4a78-9ed3-0fcd872fe5cc_750x527.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fa742ebff-dbb1-4a78-9ed3-0fcd872fe5cc_750x527.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fa742ebff-dbb1-4a78-9ed3-0fcd872fe5cc_750x527.png 1456w" sizes="100vw"></picture></a><figcaption class="image-caption">label_0C4A is most promising</figcaption></figure></div><p>The most interesting occurence is within <strong>label_0C4A</strong>. Not only does it access 0x05, it also stores into 0x05. At the bottom of the label block, we see a comment that - when translated - contains the following pseudocode:</p><pre><code>Outputs:
storage[0x05] = storage[0x06]</code></pre><p>Interesting. Can we put a value into slot 0x06? Let’s search similarly for <strong>PUSH1 0x06</strong>. There are 5 occurences.</p><div class="captioned-image-container"><figure><a class="image-link image2" target="_blank" rel="nofollow" href="https://cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F1c7a0a85-0280-47a2-b00b-68531591ee28_1002x677.png"><picture><source type="image/webp" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F1c7a0a85-0280-47a2-b00b-68531591ee28_1002x677.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F1c7a0a85-0280-47a2-b00b-68531591ee28_1002x677.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F1c7a0a85-0280-47a2-b00b-68531591ee28_1002x677.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F1c7a0a85-0280-47a2-b00b-68531591ee28_1002x677.png 1456w" sizes="100vw"><img src="https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/1c7a0a85-0280-47a2-b00b-68531591ee28_1002x677.png" width="1002" height="677" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/1c7a0a85-0280-47a2-b00b-68531591ee28_1002x677.png","fullscreen":null,"imageSize":null,"height":677,"width":1002,"resizeWidth":null,"bytes":97824,"alt":null,"title":null,"type":"image/png","href":null}" class="sizing-normal" alt="" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F1c7a0a85-0280-47a2-b00b-68531591ee28_1002x677.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F1c7a0a85-0280-47a2-b00b-68531591ee28_1002x677.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F1c7a0a85-0280-47a2-b00b-68531591ee28_1002x677.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F1c7a0a85-0280-47a2-b00b-68531591ee28_1002x677.png 1456w" sizes="100vw"></picture></a><figcaption class="image-caption">label_102A 🤯 Here we go…</figcaption></figure></div><p>Within <strong>label_102A</strong> we can directly save a stack item into slot 0x06, and then jump to the next stack item. Since we can control the stack, we can place both our 0xdeaddeaddead… address into storage slot 0x06, and then have 0C4A be next on the stack to jump to the location where the address is saved in storage slot 0x05 as owner().</p><p>Moving on to the next win condition…</p><h4>Sending away the Eth</h4><p>A useful fact to know of the EVM is that Ether is only transferable using the <strong>CALL</strong> and <strong>CALLCODE</strong> opcodes. Searching for both of these only reveals a single occurence of <strong>CALL</strong>.</p><div class="captioned-image-container"><figure><a class="image-link image2" target="_blank" rel="nofollow" href="https://cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F02fd9492-c708-444e-8b18-4d6fe09c3780_945x736.png"><picture><source type="image/webp" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F02fd9492-c708-444e-8b18-4d6fe09c3780_945x736.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F02fd9492-c708-444e-8b18-4d6fe09c3780_945x736.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F02fd9492-c708-444e-8b18-4d6fe09c3780_945x736.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F02fd9492-c708-444e-8b18-4d6fe09c3780_945x736.png 1456w" sizes="100vw"><img src="https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/02fd9492-c708-444e-8b18-4d6fe09c3780_945x736.png" width="945" height="736" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/02fd9492-c708-444e-8b18-4d6fe09c3780_945x736.png","fullscreen":null,"imageSize":null,"height":736,"width":945,"resizeWidth":null,"bytes":108721,"alt":null,"title":null,"type":"image/png","href":null}" class="sizing-normal" alt="" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F02fd9492-c708-444e-8b18-4d6fe09c3780_945x736.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F02fd9492-c708-444e-8b18-4d6fe09c3780_945x736.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F02fd9492-c708-444e-8b18-4d6fe09c3780_945x736.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F02fd9492-c708-444e-8b18-4d6fe09c3780_945x736.png 1456w" sizes="100vw"></picture></a><figcaption class="image-caption">label_191B has the only instance of CALL or CALLCODE</figcaption></figure></div><p><strong>label_191B</strong> has the only instance of CALL, so we have to go through here! We’re going to pay a lot of attention to the <strong>Inputs</strong> and <strong>Outputs</strong> comments to see what parameters the <strong>CALL</strong> uses and how we exit.</p><pre><code>Inputs:
// @194B address(0xffffffffffffffffffffffffffffffffffffffff & stack[-2]).call.gas(msg.gas).value(stack[-1])(memory[memory[0x40:0x60]:memory[0x40:0x60] + (0x00 + memory[0x40:0x60]) - memory[0x40:0x60]])
Translates To:
address(stack[2]).call.value(stack[1])("some value in memory")
Also:
Outputs
Block ends with unconditional jump to stack[4]</code></pre><p>Perfect! Since we can control the stack upon entry, we can manipulate the address we send the ETH to, the total value we are sending away, and the next location we jump to. This is enough to solve this condition and propel us straight into the next win condition…</p><h4>Removing the balance of the ERC20 Token</h4><p>Forewarning: This condition is tough to find!</p><p>Removing the balance of an ERC20 token can be approached in a few major ways.</p><ul><li><p>Directly writing to the storage slot of the _balances() mapping</p></li><li><p>Using either transfer() or transferFrom() to use the internal function _transfer() to send the balance to another address</p></li><li><p>Using internal function _burn() to zero out the value</p></li></ul><p>Of these three, the first option is not typically available for a standard ERC20 implementation. We can search around for random label_blocks that enable this, but it may not be possible.</p><p>The second and third options are doable with typical ERC20 behavior, and it’s likely that we can find these through searching the Disassembly creatively.</p><p>We know that our balance is stored in a mapping, and that mapping slot locations are determined using keccak() hashes. Let’s try to search for occurences where a <strong>SHA</strong> takes place in the Disassembly. It turns out there are 28 occurences… This is doable to backtrace each path, but is a bit much.</p><p>We also know that _transfer(), _burn() and _mint() each emit a Transfer() event. The Transfer() event uses 3 values, and is thus performed by using a <strong>LOG3</strong> opcode. Let’s search for <strong>LOG3</strong>. It turns out there are 4 occurences! This is much simpler.</p><ol><li><p>label_1263</p></li><li><p>label_1563</p></li><li><p>label_18AB</p></li><li><p>label_1E56</p></li></ol><p>While reviewing each of these options, we want to fulfill 3 main conditions:</p><ul><li><p>Access a storage slot according to a stack item</p></li><li><p>Supply a value to the slot according to a stack item</p></li><li><p>Jump to a new location according to a stack item</p></li></ul><p>Secondly, a key fact to understand is how the _balances() mapping of an ERC20 is accessed. Storage slots for mappings are accessed using </p><pre><code>//_balances() accessing pseudocode
concat(keccak(address), slot)
In our case, where address = mySetup and slot = 0x00:
concat(keccak(mySetup), bytes32(0x0))</code></pre><p>Knowing this, we also want to look for places where <strong>SSTORE</strong> not only exists amongst the label (or in prior incoming jumps), but also that it accesses storage using our stack item for address, and a slot value of 0.</p><p>To keep it brief, <strong>label_1263 </strong>fails our criteria due to it concatenating the address with slot 0x01 position, which coincides with the _allowances() mapping in an ERC20 token.</p><p>On the other hand, <strong>label_1563</strong> meets all of our criteria! </p><div class="captioned-image-container"><figure><a class="image-link image2" target="_blank" rel="nofollow" href="https://cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F639a49e7-fcc3-48ad-b593-2ccab6b24768_1022x243.png"><picture><source type="image/webp" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F639a49e7-fcc3-48ad-b593-2ccab6b24768_1022x243.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F639a49e7-fcc3-48ad-b593-2ccab6b24768_1022x243.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F639a49e7-fcc3-48ad-b593-2ccab6b24768_1022x243.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F639a49e7-fcc3-48ad-b593-2ccab6b24768_1022x243.png 1456w" sizes="100vw"><img src="https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/639a49e7-fcc3-48ad-b593-2ccab6b24768_1022x243.png" width="1022" height="243" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/639a49e7-fcc3-48ad-b593-2ccab6b24768_1022x243.png","fullscreen":null,"imageSize":null,"height":243,"width":1022,"resizeWidth":null,"bytes":56637,"alt":null,"title":null,"type":"image/png","href":null}" class="sizing-normal" alt="" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F639a49e7-fcc3-48ad-b593-2ccab6b24768_1022x243.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F639a49e7-fcc3-48ad-b593-2ccab6b24768_1022x243.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F639a49e7-fcc3-48ad-b593-2ccab6b24768_1022x243.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F639a49e7-fcc3-48ad-b593-2ccab6b24768_1022x243.png 1456w" sizes="100vw"></picture></a><figcaption class="image-caption">The bottom of label_1563</figcaption></figure></div><p>Let me pseudocode the output comment:</p><pre><code>storage[stack[3].0x00] = stack[1]
Jump Out to stack[5]</code></pre><p>In short, we are able to put in our mySetup address into memory, access the 0 slot position from there, place a value from the stack into the slot and jump out to a destination we control!</p><p>There’s only one sticking point… How do we put a 0 onto the stack?</p><p>If we refresh ourselves with the payload template, there are restrictive criteria for how we can place values onto the stack, and in particular we cannot have any values equal to 0..</p><div class="captioned-image-container"><figure><a class="image-link image2" target="_blank" rel="nofollow" href="https://cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9a57665f-505a-4945-a9ab-3cf32e8a81b0_891x183.png"><picture><source type="image/webp" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9a57665f-505a-4945-a9ab-3cf32e8a81b0_891x183.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9a57665f-505a-4945-a9ab-3cf32e8a81b0_891x183.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9a57665f-505a-4945-a9ab-3cf32e8a81b0_891x183.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9a57665f-505a-4945-a9ab-3cf32e8a81b0_891x183.png 1456w" sizes="100vw"><img src="https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/9a57665f-505a-4945-a9ab-3cf32e8a81b0_891x183.png" width="891" height="183" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/9a57665f-505a-4945-a9ab-3cf32e8a81b0_891x183.png","fullscreen":null,"imageSize":null,"height":183,"width":891,"resizeWidth":null,"bytes":30553,"alt":null,"title":null,"type":"image/png","href":null}" class="sizing-normal" alt="" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9a57665f-505a-4945-a9ab-3cf32e8a81b0_891x183.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9a57665f-505a-4945-a9ab-3cf32e8a81b0_891x183.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9a57665f-505a-4945-a9ab-3cf32e8a81b0_891x183.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9a57665f-505a-4945-a9ab-3cf32e8a81b0_891x183.png 1456w" sizes="100vw"></picture></a><figcaption class="image-caption">Word1, Word2 and Word4 cannot be == 0</figcaption></figure></div><p>As usual, with full jump access there is a creative solution we can employ! First we need to search through all potential <strong>JUMP</strong> points in the contract, and see if there are <em>any</em> that we can use to let us do this. Unfortunately, there are 197 occurences of <strong>JUMP </strong>so the searching is a bit tedious, however there is a perfect one located within <strong>label_0AF7</strong> that we can use.</p><div class="captioned-image-container"><figure><a class="image-link image2" target="_blank" rel="nofollow" href="https://cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fea103abe-7826-43c4-a0b0-b8cdca1df091_979x474.png"><picture><source type="image/webp" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fea103abe-7826-43c4-a0b0-b8cdca1df091_979x474.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fea103abe-7826-43c4-a0b0-b8cdca1df091_979x474.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fea103abe-7826-43c4-a0b0-b8cdca1df091_979x474.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fea103abe-7826-43c4-a0b0-b8cdca1df091_979x474.png 1456w" sizes="100vw"><img src="https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/ea103abe-7826-43c4-a0b0-b8cdca1df091_979x474.png" width="979" height="474" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/ea103abe-7826-43c4-a0b0-b8cdca1df091_979x474.png","fullscreen":null,"imageSize":null,"height":474,"width":979,"resizeWidth":null,"bytes":72146,"alt":null,"title":null,"type":"image/png","href":null}" class="sizing-normal" alt="" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fea103abe-7826-43c4-a0b0-b8cdca1df091_979x474.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fea103abe-7826-43c4-a0b0-b8cdca1df091_979x474.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fea103abe-7826-43c4-a0b0-b8cdca1df091_979x474.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fea103abe-7826-43c4-a0b0-b8cdca1df091_979x474.png 1456w" sizes="100vw"></picture></a><figcaption class="image-caption">You shouldn’t have! 😋</figcaption></figure></div><p><strong>label_0AF7</strong> provides a useful output for us, and is likely completely unintended! Recall that storage slot 0x06 previously held our 0xdeaddead… address before transferring it over to slot 0x05, and 0x06 ends up getting wiped in the process. This label will get the value stored in slot 0x06, place it on the stack, and jump out to the stack item underneath it. This looks like the duty of a typical <strong>public getter() </strong>Solidity function, and we are going to abuse it to place in a hard-to-get 0 to the top of the stack, and let us jump out to the nice <strong>label_1563</strong> destination to place it into the _balances() mapping. </p><p>Lastly…</p><h4>We Need to Make it Out</h4><p>Now that our win conditions are theoretically solved for, we need to exit the contract. The simplest way to do this is search for <strong>JUMPDEST</strong>s immediately followed by a <strong>STOP</strong>. A brief search for <strong>STOP</strong> shows <strong>label_0366</strong> performs this perfectly.</p><div class="captioned-image-container"><figure><a class="image-link image2" target="_blank" rel="nofollow" href="https://cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fbbff793e-cb96-494b-8f69-97d1edab7a85_570x152.png"><picture><source type="image/webp" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fbbff793e-cb96-494b-8f69-97d1edab7a85_570x152.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fbbff793e-cb96-494b-8f69-97d1edab7a85_570x152.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fbbff793e-cb96-494b-8f69-97d1edab7a85_570x152.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fbbff793e-cb96-494b-8f69-97d1edab7a85_570x152.png 1456w" sizes="100vw"><img src="https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/bbff793e-cb96-494b-8f69-97d1edab7a85_570x152.png" width="570" height="152" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/bbff793e-cb96-494b-8f69-97d1edab7a85_570x152.png","fullscreen":null,"imageSize":null,"height":152,"width":570,"resizeWidth":null,"bytes":25363,"alt":null,"title":null,"type":"image/png","href":null}" class="sizing-normal" alt="" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fbbff793e-cb96-494b-8f69-97d1edab7a85_570x152.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fbbff793e-cb96-494b-8f69-97d1edab7a85_570x152.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fbbff793e-cb96-494b-8f69-97d1edab7a85_570x152.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fbbff793e-cb96-494b-8f69-97d1edab7a85_570x152.png 1456w" sizes="100vw"></picture></a><figcaption class="image-caption">JUMPDEST → STOP</figcaption></figure></div><p></p><h4>Putting It All Together</h4><p>We finally have our gameplan! To review:</p><ul><li><p>Call <strong>0x27f83350</strong> to place in a favorable <strong>JUMPDEST</strong> location <strong>19FC</strong> into slot <strong>0x0b</strong></p></li><li><p>Next, enter contract again through <strong>buyTokens</strong>() with a <strong>msg.value</strong> of <strong>4 wei</strong></p></li><li><p>Loop repeatedly through <strong>19FC</strong> to stack values that perform the following:</p><ul><li><p>Jump to <strong>102A</strong> letting us store <strong>0xdeaddead…</strong> address in slot <strong>0x06</strong></p></li><li><p>Jump to <strong>0C4A</strong> to transfer <strong>0xdeaddead…</strong> from slot <strong>0x06</strong> → slot <strong>0x05</strong></p><ul><li><p>This in turn will zero out slot <strong>0x06</strong></p></li></ul></li><li><p>Jump to <strong>191B</strong> to drain (<strong>50 ether + 4 wei</strong>) from the contract to address <strong>0x1111…</strong></p><ul><li><p>(All non-challenge addresses will work in place of 0x1111…)</p></li></ul></li><li><p>Jump to <strong>0AF7</strong> to place slot 0x06’s value (now housing a 0) onto the stack</p></li><li><p>Jump to <strong>1563</strong> to place <strong>address(mySetup)</strong> into memory[0x00:0x20] and have the <strong>SSTORE</strong> place the created 0x00 into our balances mapping.</p></li><li><p>Jump to <strong>0366</strong> to <strong>STOP</strong> execution in the contract and end our transaction.</p></li></ul></li></ul><p></p><p>Reviewing the payload template from earlier, we just need to place these variables into our calldata so that they are read back-to-front accordingly.</p><div class="captioned-image-container"><figure><a class="image-link image2" target="_blank" rel="nofollow" href="https://cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F64dc1a54-f383-4bf6-abdf-060ab840ac9c_1024x349.png"><picture><source type="image/webp" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F64dc1a54-f383-4bf6-abdf-060ab840ac9c_1024x349.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F64dc1a54-f383-4bf6-abdf-060ab840ac9c_1024x349.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F64dc1a54-f383-4bf6-abdf-060ab840ac9c_1024x349.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F64dc1a54-f383-4bf6-abdf-060ab840ac9c_1024x349.png 1456w" sizes="100vw"><img src="https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/64dc1a54-f383-4bf6-abdf-060ab840ac9c_1024x349.png" width="1200" height="408.984375" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/64dc1a54-f383-4bf6-abdf-060ab840ac9c_1024x349.png","fullscreen":false,"imageSize":"large","height":349,"width":1024,"resizeWidth":1200,"bytes":60203,"alt":null,"title":null,"type":"image/png","href":null}" class="sizing-large" alt="" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F64dc1a54-f383-4bf6-abdf-060ab840ac9c_1024x349.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F64dc1a54-f383-4bf6-abdf-060ab840ac9c_1024x349.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F64dc1a54-f383-4bf6-abdf-060ab840ac9c_1024x349.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F64dc1a54-f383-4bf6-abdf-060ab840ac9c_1024x349.png 1456w" sizes="100vw"></picture></a><figcaption class="image-caption">Top: Payload Template, Bottom: Actual Values</figcaption></figure></div><h2>Finish Him! 😈</h2><p>We finally head to our myExploit contract to add in the last piece of the puzzle. In the aptly named <strong>step2()</strong> function, we assemble our payload using <strong>bytes memory</strong> and <strong>abi.encodePacked()</strong> before sending it off to the <strong>challengeAddress</strong> using a <strong>call()</strong>.</p><p>As a reminder, we use a selector of <strong>d0febe4c </strong>that lets us enter through buyTokens(), and we use a msg.value of 4 wei so that the beginning calldata offset begins after the buyTokens() selector.</p><div class="captioned-image-container"><figure><a class="image-link image2" target="_blank" rel="nofollow" href="https://cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fdb21c0c2-6b33-4148-8f7b-5ee41aceaf32_2295x449.png"><picture><source type="image/webp" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fdb21c0c2-6b33-4148-8f7b-5ee41aceaf32_2295x449.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fdb21c0c2-6b33-4148-8f7b-5ee41aceaf32_2295x449.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fdb21c0c2-6b33-4148-8f7b-5ee41aceaf32_2295x449.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fdb21c0c2-6b33-4148-8f7b-5ee41aceaf32_2295x449.png 1456w" sizes="100vw"><img src="https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/db21c0c2-6b33-4148-8f7b-5ee41aceaf32_2295x449.png" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/db21c0c2-6b33-4148-8f7b-5ee41aceaf32_2295x449.png","fullscreen":false,"imageSize":"full","height":285,"width":1456,"resizeWidth":null,"bytes":82245,"alt":null,"title":null,"type":"image/png","href":null}" class="sizing-fullscreen" alt="" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fdb21c0c2-6b33-4148-8f7b-5ee41aceaf32_2295x449.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fdb21c0c2-6b33-4148-8f7b-5ee41aceaf32_2295x449.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fdb21c0c2-6b33-4148-8f7b-5ee41aceaf32_2295x449.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fdb21c0c2-6b33-4148-8f7b-5ee41aceaf32_2295x449.png 1456w" sizes="100vw"></picture></a><figcaption class="image-caption">Both of our exploiting functions</figcaption></figure></div><p>We write another testing function and run <strong>forge test -m testStep2</strong>:</p><div class="captioned-image-container"><figure><a class="image-link image2" target="_blank" rel="nofollow" href="https://cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F2e5071fb-ee5a-4c97-94c0-7f68b8a41ac1_485x152.png"><picture><source type="image/webp" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F2e5071fb-ee5a-4c97-94c0-7f68b8a41ac1_485x152.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F2e5071fb-ee5a-4c97-94c0-7f68b8a41ac1_485x152.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F2e5071fb-ee5a-4c97-94c0-7f68b8a41ac1_485x152.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F2e5071fb-ee5a-4c97-94c0-7f68b8a41ac1_485x152.png 1456w" sizes="100vw"><img src="https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/2e5071fb-ee5a-4c97-94c0-7f68b8a41ac1_485x152.png" width="485" height="152" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/2e5071fb-ee5a-4c97-94c0-7f68b8a41ac1_485x152.png","fullscreen":null,"imageSize":null,"height":152,"width":485,"resizeWidth":null,"bytes":12343,"alt":null,"title":null,"type":"image/png","href":null}" class="sizing-normal" alt="" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F2e5071fb-ee5a-4c97-94c0-7f68b8a41ac1_485x152.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F2e5071fb-ee5a-4c97-94c0-7f68b8a41ac1_485x152.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F2e5071fb-ee5a-4c97-94c0-7f68b8a41ac1_485x152.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F2e5071fb-ee5a-4c97-94c0-7f68b8a41ac1_485x152.png 1456w" sizes="100vw"></picture></a><figcaption class="image-caption">Our exploit testing function</figcaption></figure></div><div class="captioned-image-container"><figure><a class="image-link image2" target="_blank" rel="nofollow" href="https://cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Ff2dd62c5-faae-43d9-afbe-b62ec3188070_535x132.png"><picture><source type="image/webp" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Ff2dd62c5-faae-43d9-afbe-b62ec3188070_535x132.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Ff2dd62c5-faae-43d9-afbe-b62ec3188070_535x132.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Ff2dd62c5-faae-43d9-afbe-b62ec3188070_535x132.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Ff2dd62c5-faae-43d9-afbe-b62ec3188070_535x132.png 1456w" sizes="100vw"><img src="https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/f2dd62c5-faae-43d9-afbe-b62ec3188070_535x132.png" width="535" height="132" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/f2dd62c5-faae-43d9-afbe-b62ec3188070_535x132.png","fullscreen":null,"imageSize":null,"height":132,"width":535,"resizeWidth":null,"bytes":24649,"alt":null,"title":null,"type":"image/png","href":null}" class="sizing-normal" alt="" srcset="https://cdn.substack.com/image/fetch/w_424,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Ff2dd62c5-faae-43d9-afbe-b62ec3188070_535x132.png 424w, https://cdn.substack.com/image/fetch/w_848,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Ff2dd62c5-faae-43d9-afbe-b62ec3188070_535x132.png 848w, https://cdn.substack.com/image/fetch/w_1272,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Ff2dd62c5-faae-43d9-afbe-b62ec3188070_535x132.png 1272w, https://cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Ff2dd62c5-faae-43d9-afbe-b62ec3188070_535x132.png 1456w" sizes="100vw"></picture></a><figcaption class="image-caption">Sweet, sweet victory</figcaption></figure></div><h1>🎉🎉🎉🎉🎉🎉🎉🎉🎉🎉🎉🎉🎉🎉🎉</h1><p>We did it! Our payload completes each of the 3 win conditions and exits the contract gracefully. Kudos to all who’ve made it to this point. You’ve tackled one of the hardest CTF puzzles Ethereum has to offer… so far 😉</p><p>If you’d like to run the code and view it all yourself, check out my repo: https://github.com/plotchy/jop-foundry</p><p>This is the debut of my content, so if you’re interested in deep dives similar to this one, feel free to follow me on the bird site.</p><p>If you’re a fellow student of Ethereum and want help with a hard problem that needs solving, reach out!</p><p>If you’re a recruiter within Ethereum Security, let’s talk! 👨💻</p><p></p><p>Twitter 🐦️ <a href="https://twitter.com/plotchy">@plotchy</a></p>