Level 18 - Magic Number ⏺⏺⏺

The EthernautOpenZeppelin

Level Setup

To solve this level, you only need to provide the Ethernaut with a Solver, a contract that responds to whatIsTheMeaningOfLife() with the right number.

Easy right? Well... there's a catch.

The solver's code needs to be really tiny. Really reaaaaaallly tiny. Like freakin' really really itty-bitty tiny: 10 opcodes at most.

Hint: Perhaps its time to leave the comfort of the Solidity compiler momentarily, and build this one by hand O_o. That's right: Raw EVM bytecode.

Good luck!

Level Contract

ethernaut/contracts/src/levels/MagicNum.sol at a89c8f7832258655c09fde16e6602c78e5e99dbd · OpenZeppelin/ethernautGitHub

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

contract MagicNum {
    address public solver;

    constructor() {}

    function setSolver(address _solver) public {
        solver = _solver;
    }

    /*
    ____________/\\\_______/\\\\\\\\\_____        
     __________/\\\\\_____/\\\///////\\\___       
      ________/\\\/\\\____\///______\//\\\__      
       ______/\\\/\/\\\______________/\\\/___     
        ____/\\\/__\/\\\___________/\\\//_____    
         __/\\\\\\\\\\\\\\\\_____/\\\//________   
          _\///////////\\\//____/\\\/___________  
           ___________\/\\\_____/\\\\\\\\\\\\\\\_ 
            ___________\///_____\///////////////__
    */
}

Exploit

Anvil

make anvil-exploit-level-18

<INPUT_LEVEL_INSTANCE_CONTRACT_ADDRESS>

Holesky

Exploit Deployment Script

ethernaut-foundry/script/Level18.s.sol at 4b358891e664180abd54a2b5e04460b5e63bacfd · EridianAlpha/ethernaut-foundryGitHub

script/Level18.s.sol

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

import {Script, console} from "forge-std/Script.sol";
import {HelperFunctions} from "script/HelperFunctions.s.sol";

// ================================================================
// │                      LEVEL 18 - MAGIC NUMBER                 │
// ================================================================
interface IMagicNum {
    function setSolver(address _solver) external;
}

contract Exploit is Script, HelperFunctions {
    function run() public {
        address targetContractAddress = getInstanceAddress();

        vm.startBroadcast();

        // Store the contract bytecode
        bytes memory bytecode = hex"600a600c600039600a6000f3602a60505260206050f3";

        // Deploy the contract using create
        address deployedAddress;
        assembly {
            deployedAddress := create(0, add(bytecode, 0x20), mload(bytecode))
        }

        // Set the solver address
        IMagicNum(targetContractAddress).setSolver(address(deployedAddress));

        vm.stopBroadcast();
    }
}

Submit instance... 🥳

Completion Message

Congratulations! If you solved this level, consider yourself a Master of the Universe.

Go ahead and pierce a random object in the room with your Magnum look. Now, try to move it from afar; Your telekinesis abilities might have just started working.

Notes

ethernaut-openzeppelin-hacks/level_18_Magic-Number.md at main · nvnx7/ethernaut-openzeppelin-hacksGitHub