finleyexp

Capture the Ether Writeup

This writeup is a runthrough of challenges at https://capturetheether.com/challenges/ built on the Ropsten testnet. I will go through each problem in four steps:

1. The intention of the contract
2. The flawed assumption
3. The process of exploiting the vulnerability
4. The potential patches

I'll provide examples of the code I wrote as needed. To save time, we'll skip into the Lotteries section, starting with Guess the secret number, as that's the first problem which truly required some thought.

finleyexp

// DON'T USE. INTENDED FOR EDUCATIONAL PURPOSES ONLY. PLUS, it errors.
// adapted from: https://tij.me/blog/scamming-people-via-ethereum-smart-contracts/

pragma solidity >=0.4.24 <0.7.0;

contract iGuess {

    uint256 private secretNumber;
    uint256 public lastPlayed;
    address public owner;