Using contracts to store data efficiently

Reverse engineer a profitable MEV strategy

Understanding the "why" of various gas optimizations

What types of flows consume the most gas?

Grokking proxies & clones using just 2 opcodes

Interesting CREATE2 use cases

The CTF that will make you write Yul and Huff

Bend Ethereum bytecode to your will

Anonymize your transactions to escape the on-chain investigatoors.

Escape @zachxbt and @samczsun

Ethereum bytecode is immutable once it’s deployed. It will do exactly what it’s programmed to do. There is no way to alter it. This is what allows for permissionless decentralized applications on Ethereum.

In this CTF, we are actually going to debunk this myth. We are going to make Ethereum bytecode mutable. In the following 3 tasks, you will make the bytecode behave differently from what it's programmed to do.

Here is what you will learn by the end of this CTF:

How to change a contract's private storage without its permission

How to execute code on-chain without leaving a trace

How to deploy 2 different contracts to the same exact address 

How to change the bytecode of a deployed contract

. It’s a battleship game where you write smart contracts (bots) to play against other smart contracts. It’s like 

Your task is to win a bot I wrote, but without playing. This bot is actually a very sophisticated one. I spent a couple of days implementing it. No one has beaten it so far (by following the game rules, which we are not going to do in this task…).

Don’t worry about the game rules. You won’t need them to win the game. You will use an exploit instead. But to actually exploit the game, you will need to learn about constructors (that’s your first hint!).

Now that you know how a contract gets deployed and stored on-chain, let’s get back to our task. Your task is to win this 

. It’s a sophisticated bot that I built to play my on-chain battleship game 

You don't have the source code of this bot. You have the source code for the 

 but you don’t really need to understand it. All you need to understand is that the game implements the pattern shown below, and every bot must implement the 

 interface (the code below is not 100% accurate, I simplified it in most places for readability):

interface IBot {
    // nickname of your bot
    function name() external view returns (string memory);

    // must be the address you will be calling the Game contract from.
    // this value is to check that no one else is using your code to play.
    function owner() external view returns (address);

    // this function needs to return an index into the 8x8 board, i.e. a value between [0 and 64).
    // a shell will be fired at this location
    function fire(
        uint256 myBoard,
        uint256 myAttacks,
        uint256 opponentsAttacks,
        uint256 myLastMove,
        uint256 opponentsLastMove,
        uint256 opponentsDiscoveredFleet
    ) external returns (uint256);
}

contract Game {
	function submitChallenge(address bot, bytes32 fleetHash) external {
		if (IBot(bot).owner() != msg.sender) revert NotYourGeneral();
		// ...save the challenge and emit challengeHash
	}

	function acceptChallenge(address bot, bytes32 fleetHash, bytes32 challengeHash) external {
		if (IBot(bot).owner() != msg.sender) revert NotYourGeneral();
		// ...a challenge between two bots is now locked
	}

	function startBattle(bytes32 challengeHash) external {
		// ...initialize game state

		// run game loop
		uint256 currentTurnIdx = // randomly choose between 0 and 1
    for (uint256 i=0; i < maxTurns; i++) {
			bots[currentTurnIdx].fire(/* ...gameState */);
			// ...update game state
	    currentTurnIdx = (currentTurnIdx + 1) % 2;
		}

    // ...determine the winner        
	}
}

 (whose nickname is “khabib” because he is strong). 

Deploy your bot and provide the address of the bot to the frontend (after clicking the “Accept challenge” button).

You can then watch the replay of your battle to see if you won.

I have set up some automation such that a new challenge against khabib is automatically submitted after a battle takes place so that other students can also try their hand against khabib.

 of your winning battle against khabib. The thing below will automatically verify that you won against khabib. Keep in mind that the 

 of your bot needs to be the same address with which you’re logged in now. 

The game is on Goerli testnet by the way. If you need some Goerli ETH, DM me on Discord. Just pay attention to what interface the bot implements and how the game calls the bots. You don’t need to read the game contract in detail to win.

Bend Ethereum bytecode to your will

Win a game without even playing

Break the deadlock

Ethereum bytecode is not immutable

Prove your knowledge on-chain