Russian_Roulette.md

Russian Roulette

Welcome to The Fray. This is a warm-up to test if you have what it takes to tackle the challenges of the realm. Are you brave enough?

RPC: http://94.237.53.81:38453/

1- Setup.sol

pragma solidity 0.8.23;

import {RussianRoulette} from "./RussianRoulette.sol";

contract Setup {
    RussianRoulette public immutable TARGET;

    constructor() payable {
        TARGET = new RussianRoulette{value: 10 ether}();
    }

    function isSolved() public view returns (bool) {
        return address(TARGET).balance == 0;
    }
}

2- RussianRoulette.sol

pragma solidity 0.8.23;

contract RussianRoulette {

    constructor() payable {
        // i need more bullets
    }

    function pullTrigger() public returns (string memory) {
        if (uint256(blockhash(block.number - 1)) % 10 == 7) {
            selfdestruct(payable(msg.sender)); // 💀
        } else {
        return "im SAFU ... for now";
        }
    }
}

Solve

Note

All information such as the contract address, the private and public key of the player's wallet has been provided. I didn't see this information and assumed that I've only the RPC provider http://94.237.53.81:38453/

Collecting infos

1- Get the number of blocks

cast block --rpc-url http://94.237.53.81:38453

It returns 1 block with 1 Transaction

baseFeePerGas        0
difficulty           0
extraData            0x
gasLimit             30000000
gasUsed              215475
hash                 0x9c16c8140be52d96488727b2e1b1e9dd96377ae72ad3774ac3bdbfec05a509f1
logsBloom            0x00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
miner                0x0000000000000000000000000000000000000000
mixHash              0x0000000000000000000000000000000000000000000000000000000000000000
nonce                0x0000000000000000
number               1
parentHash           0x92facefba267674be1a96bab1d53ff1094ea01f527490a8fb43f3112e2ecdb67
transactionsRoot     0xf6339cf0a4d243debd92167dd42d9da085c0e45926687faaae3469e6d24ef55b
receiptsRoot         0xc9a255c487ed5e98af49b05c9197028e5fb557c05cfd10ef665433aa2e55d2c0
sealFields           []
sha3Uncles           0x1dcc4de8dec75d7aab85b567b6ccd41ad312451b948a7413f0a142fd40d49347
size                 1371
stateRoot            0x5ba575b7226cf045bfad817548b0bc6c26ffbf86044300892affec2ec49038c0
timestamp            1710018054
withdrawalsRoot      
totalDifficulty      0
transactions:        [
        0xa6bb7e91fca969eaf726cac0db88482a4bcab2a2ede8cfe121d9bdc891c57676
]

2- Read the transaction 0xa6b...676 inside the block number 1

cast receipt 0xa6bb7e91fca969eaf726cac0db88482a4bcab2a2ede8cfe121d9bdc891c57676  --rpc-url http://94.237.53.81:38453

It returns the contract addresse 0x8514F86e5B32B036291c78A2E4182Fb0572358bC

blockHash               0x926795adee0da0829ef11bf7fe51838c7a9a7ec3d66eb45af4e63da8001947bf
blockNumber             1
contractAddress         0x8514F86e5B32B036291c78A2E4182Fb0572358bC
cumulativeGasUsed       215475
effectiveGasPrice       0
from                    0x119A426CC85e225C6Df3a65186A671Ccd705D249
gasUsed                 215475
logs                    []
logsBloom               0x00000000000000000000000000000000000000000000000000000000000...
root                    
status                  1
transactionHash         0xa6bb7e91fca969eaf726cac0db88482a4bcab2a2ede8cfe121d9bdc891c57676
transactionIndex        0
type                    0
depositNonce             null

📌 Setup.sol Address 0x8514F86e5B32B036291c78A2E4182Fb0572358bC

3- Call TAGET() Method to get RussianRoullet.sol contract Address

cast call 0x8514F86e5B32B036291c78A2E4182Fb0572358bC --rpc-url http://94.237.53.81:38453 "TARGET()(address)" 

It return the address of the contract

0x37b9f2DD986562D058ab5A2418873c9442f54BE8

📌 RussianRoullet.sol Address 0x37b9f2DD986562D058ab5A2418873c9442f54BE8

Exploit the smart contract weakness

To solve this challenge we need to Transact 7 times with pullTrigger() to mine 7 blocks.

🤔 Why 7 times? Each transaction increment the number of blocks by 1, we need to mine 7 blocks to complete the 7 /*current block*/ % 10 == 7

function pullTrigger() public returns (string memory) {
    // uint256(blockhash(block.number - 1) -> return the current block.
    if (uint256(blockhash(block.number - 1)) % 10 == 7) {
        selfdestruct(payable(msg.sender)); // 💀
    }
    ...