Privacy — Ethernaut — smart contract hacking
Task
unlock the contract
- Understanding how storage works
- Understanding how parameter parsing works
- Understanding how casting works
how storage works
storage refers to persistent mutable storage variables.Accessing and modifying storage variables incur higher gas costs compared to variables in memory. data is organised into 32 byte slots.
they have visibility modifiers public, private, internal,external.
Solidity uses pointers to reference storage variables. When you assign a storage variable to another variable, it creates a pointer to the original storage slot. Modifications made to the new variable will affect the original storage location.
use local variables (memory) instead of storage variables whenever possible. Additionally, consider using mappings and arrays efficiently to store and access data.
Never store private data on blockchain
private state variables can be read.other contracts can’t access that data but everything on blockchain is public.
how EVM stores state variables
EVM stores state variables in slots. 2**256 in total.each slot holds up 32 bytes. variables are stored in order of declaration. then EVM will pack these state variables from right to left.
constant variables aren’t stored in storage. they are hard-coded into contract byte code.
uint32[3] public data — 32 bytes array of size 3, which EVM will store these state variables sequentially.(e.g first element will be stored in slot 3, second — 4 , third — 5) .
formula to find array element slot
keccak256(slot) + (index * elementsize)
formula to find mapping element slot
keccak256(key, slot)
parameter parsing
Parameter parsing in Solidity involves extracting and interpreting input data passed to a function in a smart contract. When a function is called, the input parameters are encoded in a specific format according to the Application Binary Interface (ABI) specification. The contract then needs to parse this encoded data to access and interpret the individual parameter values.
casting
implicit casting — automatic casting between certain compatible data types.
Get natnat’s stories in your inbox
Join Medium for free to get updates from this writer.
explicit casting — required when converting between incompatible data types or narrowing the size of data type. solidity provides casting operators.
truncation and extension — truncation larger to smaller, extension smaller to larger
address casting — casting an address to another address type can be done using the payable address type.
byte array casting — casting operations for converting between byte arrays and other types.
SOLVING
code
1st slot => locked boolean & ID
2nd slot => flattening(8byte), denomination(8byt)e, awkwardness(16byte)
3,4,5th slot => data
to get data from certain slot we can use getStorageAt function.
the returned address is 32byte. to convert that to 16 we have to create attack script.
first deploy the contract in remix at instance address.
then import that contract into our attack script.
the above code takes contract and passes it 32 byte address, which then will be converted to 16 byte address and will be passed into unlock function to unlock the contract.
check if contract is unlocked:
The challenge is solved
