12-Privacy.md

Ethernaut 12-Privacy

本关目标

• unlock 合约，设置 locked=false

合约分析

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

contract Privacy {

  bool public locked = true;
  uint256 public ID = block.timestamp;
  uint8 private flattening = 10;
  uint8 private denomination = 255;
  uint16 private awkwardness = uint16(block.timestamp);
  bytes32[3] private data;

  constructor(bytes32[3] memory _data) {
    data = _data;
  }

  function unlock(bytes16 _key) public {
    // 只要我们传入的_key和data[2]相同就可以解锁
    require(_key == bytes16(data[2]));
    locked = false;
  }

  /*
    A bunch of super advanced solidity algorithms...

      ,*'^`*.,*'^`*.,*'^`*.,*'^`*.,*'^`*.,*'^`
      .,*'^`*.,*'^`*.,*'^`*.,*'^`*.,*'^`*.,*'^`*.,
      *.,*'^`*.,*'^`*.,*'^`*.,*'^`*.,*'^`*.,*'^`*.,*'^         ,---/V\
      `*.,*'^`*.,*'^`*.,*'^`*.,*'^`*.,*'^`*.,*'^`*.,*'^`*.    ~|__(o.o)
      ^`*.,*'^`*.,*'^`*.,*'^`*.,*'^`*.,*'^`*.,*'^`*.,*'^`*.,*'  UU  UU
  */
}

解决方案

1. 解决关键在于知道 data[2]的值
2. locked->slot0、Id->slot1、flattening+denomination+awkwardness->slot2、data[0]->slot3、data[1]->slot4、data[2]-->slot5
3. 获取合约 storage 中的 slot5 中的值即可 await web3.eth.getStorageAt(contract.address, 5)
4. 直接使用获取的 slot5 值调用 unlock