/Rareskills-auditing-hacking

Rareskills-auditing-hacking

Ethernaut-solutions

Solutions to https://ethernaut.openzeppelin.com/ with Explanations and References

Week 5

Day 1: Insecure Randomness

watch insecure randomness

  • Ethernaut #3 (coinflip)
  • Capture the Ether Guess the random number

Day 2: View function errors

  • Ethernaut #11 Elevator
  • Ethernaut #21 Shop (NOTE: Ethernaut expects the public variable price to be less than 100 after the puzzle is solved)

Day 3: Unsafe number casting

  • Capture the Ether Guess the secret number
  • Capture the Ether Guess the new number
  • Capture the Ether predict the future

Day 4: re-entrancy

read: reentrancy

  • Ethernaut #10 Re-entrancy
  • RareSkills Riddles: ERC1155
  • Capture the Ether Token Bank (this is challenging)

Week 6

Day 7: blockhash lookback

  • Capture the Ether Predict the block hash (this is challenging)

Read here for a hint: https://docs.soliditylang.org/en/v0.4.24/units-and-global-variables.html#block-and-transaction-properties

Day 8-9: arithmetic overflow

Note: You can use what you learned from the fuzzing week to solve these

  • Ethernaut #5 Token
  • Capture the Ether Token Whale Challenge
  • Capture the Ether Token Sale (this one is more challenging)

Day 10-12: flawed or mixed accounting

watch selfdestruct

read dangers of mixed accounting

  • Ethernaut #7 Force
  • Capture the Ether Retirement fund
  • Damn Vulnerable Defi #4 Side Entrance
  • Damn Vulnerable Defi #1 Unstoppable (this is challenging)

Week 7

Day 13: Business logic errors (and ABI encoding Prerequisite)

  • RareSkills Riddles: Forwarder
  • RareSkills Riddles: Assign Votes

Day 14-15: ERC20

  • Ethernaut #15 Naught Coin
  • Damn Vulnerable Defi #3 Truster (this is challenging)

Day 16: msg.sender spoofing

  • RareSkills Riddles: Overmint3
  • RareSkills Riddles: Democracy

Day 17: Storage pointer

  • RareSkills Riddles: Delete user (this is challenging)

Week 8

Day 18-19: Issues with the delete keyword

  • RareSkills Riddles: Viceroy (this is a lot more challenging compare to earlier CTFs)

Day 20: Denial of service / gas griefing

  • Ethernaut #9 King
  • Ethernaut #20 Denial

Day 21: Access control or bad input validation

  • Ethernaut #23 Dex2
  • Ethernaut #17
  • Damn Vulnerable DeFi #2 Naive Receiver

Week 9

Day 22: Private Variables

Watch: private variables

  • Ethernaut #8 Vault

Day 23: Cross function re-entrancy

  • RareSkills Riddles: RewardToken

Day 24: Flash loan attacks part 1

  • RareSkills Riddles: Simple flash loan (this is very time consuming)

Day 25: Read-only Re-entrancy

  • RareSkills Riddles: Read-only reentrancy

Week 10

Day 26-30: Flash loan attacks part 2

  • Prerequisite: ERC20Snapshot
  • Damn Vulnerable DeFi #5
  • Damn Vulnerable DeFi #6