DEV Community: Jenny T.

Cómo Hackeé un Juego de Dados en Blockchain (y Tú También Puedes)

Jenny T. — Tue, 12 Aug 2025 12:31:03 +0000

Mi experiencia aprendiendo seguridad en contratos inteligentes a través del hacking ético gracias a dev3pack HAZLO TU MISMO
https://speedrunethereum.com/challenge/dice-game

Un Juego "Aleatorio" Que No Lo Era Tanto

Cuando estoy por completar el challenge de Dice Game en SpeedRunEthereum. La premisa era simple: un contrato que simula un juego de dados donde puedes apostar 0.002 ETH y si sale un número del 0 al 5, ganas el premio acumulado.

Sonaba justo, ¿verdad? Pero había un detalle: el challenge me pedía hackear el sistema.

¿Cómo se hackea algo aleatorio?

Al principio pensé que era imposible. Si los números son realmente aleatorios, ¿cómo predecir el resultado? Pero aquí aprendí la primera lección importante:

En blockchain, la verdadera aleatoriedad es extremadamente difícil de lograr.

Investigando el Código: El Momento Eureka

Cuando abrí el contrato DiceGame.sol, encontré esta línea:

solidity
bytes32 prevHash = blockhash(block.number - 1);
bytes32 hash = keccak256(abi.encodePacked(prevHash, address(this), nonce));
uint256 roll = uint256(hash) % 16;

¡Ahí estaba! El "número aleatorio" se generaba usando:

Hash del bloque anterior (público)
Dirección del contrato (conocida)
Un nonce que se incrementa (también público)

Todos estos valores son completamente predecibles.

El Hack: Creando Mi Contrato Atacante

La estrategia fue simple pero efectiva:

Replicar exactamente la misma lógica de generación de números
Predecir el resultado antes de apostar
Solo apostar cuando esté garantizado que voy a ganar

solidity
function riggedRoll() public payable {
    // Predecir usando la MISMA lógica que DiceGame
    uint256 nonce = diceGame.nonce();
    uint256 randomNumber = uint256(keccak256(abi.encodePacked(
        blockhash(block.number - 1), 
        address(diceGame), 
        nonce
    ))) % 16;

    // Solo apostar si voy a ganar (0-5)
    require(randomNumber <= 5, "Would lose! Not rolling");

    // Hacer la apuesta garantizada
    diceGame.rollTheDice{value: 0.002 ether}();
}

Los Errores (Y Aprendizajes) En El Camino

Error #1: Fondos Insuficientes

Mi primer intento falló porque no tenía suficiente ETH para las fees de gas.

Lección: En testnet, siempre pide ETH de varios faucets.

Mi favorito es https://cloud.google.com/application/web3/faucet/ethereum/sepolia

Error #2: Versiones de Solidity

El compilador se quejaba de versiones incompatibles entre contratos.

Lección: Mantén consistencia en las versiones o configura múltiples compiladores.

Error #3: Configuración de Red

Al hacer deploy a Sepolia, tuve problemas de configuración de red.

Lección: Lee bien los archivos de configuración antes de hacer deploy.

El Momento de la Verdad: Probando el Hack

Cuando finalmente ejecuté riggedRoll(), pasaron dos cosas:

Algunas veces: "Would lose! Not rolling" - El contrato se negó a apostar
Otras veces: Transacción exitosa y... ¡GANÉ!

Ver este mensaje en la terminal fue increíble:

Los Números No Mienten

Probabilidad normal de ganar: 37.5% (6 de 16 números)
Mi probabilidad de ganar: 100% (solo apostaba cuando iba a ganar)
Pérdidas por apuestas malas: 0

El Deploy Final: De Local a Público

Después de probar localmente, llevé el proyecto a Sepolia testnet:

DiceGame: 0x2573B3F144fAf76E8C8BB29D789a2CdAf1d60579
RiggedRoll: 0xfB9495B24dC40bAA7c1719170836cdAe04b2c0da

Puedes verificar los contratos en Sepolia Etherscan.

Reflexiones Finales

Este proyecto me enseñó que la seguridad en blockchain no es solo sobre escribir código que compile. Es sobre entender las implicaciones de cada línea, especialmente cuando manejas dinero real.

Para desarrolladores: Siempre asume que alguien intentará hackear tu contrato. Porque probablemente lo hará.

Para usuarios: Entiende los riesgos antes de interactuar con contratos en mainnet.

Pruébalo En Vivo
Puedes interactuar con mi hack directamente:

App en vivo: https://jenny-game-rust.vercel.app/
Contratos en Sepolia: https://sepolia.etherscan.io/address/0xfB9495B24dC40bAA7c1719170836cdAe04b2c0da
Código fuente: https://github.com/JennyT3/dice-game-hack

Solo necesitas conectar tu wallet a Sepolia testnet y conseguir un poco de ETH del faucet.

Agradecimientos
Este proyecto no habría sido posible sin:
dev3pack Por la oportunidad de ser parte del programa de becas Web3 y el campamento de desarrollo que me introdujo a estos conceptos.
BuidlGuidl Por crear SpeedRunEthereum y hacer que aprender desarrollo blockchain sea accesible y divertido.
Lisk Por respaldar el programa y proporcionar recursos educativos de alta calidad.

Gracias especiales a todos los mentores y compañeros del programa que hicieron posible esta experiencia de aprendizaje.

Enlaces útiles:

Test Defindex dApp on Testnet

Jenny T. — Fri, 22 Nov 2024 15:57:34 +0000

In this guide, you will learn how to create and manage a Vault on the Defindex 🔁 dApp Testnet, step by step. This platform allows you to strategically manage assets, interact with different investment options, and perform secure tests in a testnet environment.

To get started, visit our website and explore the documentation:
👉🏽 Website: https://www.defindex.io/
📚 Documentation: https://docs.defindex.io/

Set Up Your Wallet

To begin, you need a compatible wallet. Defindex 🔁 supports Freighter, Xbull, and Lobstr wallets.

Choose one of the supported wallets and follow the instructions to connect it to the Defindex Testnet dApp.

Mint Test Tokens

If you don’t have any test tokens in your wallet, you can mint them directly on the platform.

How to mint tokens?
Simply navigate to the minting page, select the amount of test tokens you wish to receive, and mint them into your wallet.

Create Vault

Once your wallet is connected and you have test tokens, you can create a new vault.

Click on “Add Vault”: This starts the vault creation process.
Enter a Name and Symbol (Ticker): Choose a name and symbol for your vault. This will help you identify the vault in the future.

💡Tip: Keep your vault names simple and meaningful to easily differentiate them later.

Add Investment Strategies

To define how the funds in your vault will be managed, add one or more strategies:

Click on “Add Strategy”: Choose the strategy you want to link to your vault.

Choose Your Strategy:

HODL: Keep the assets long-term with no changes.
Blend: Mix different strategies for diversified investments.
Fixed: Use a pre-defined, fixed return strategy.

Configure Vault Details

Before finalizing your vault, make sure to configure the following

Review Your Strategies: Ensure the strategies linked to your vault are correct.

Manager Settings

Provide the address of the Manager and Emergency Manager.

Manager: Responsible for rebalancing the vault, making emergency withdrawals, and investing idle funds.

Emergency Manager: Has the authority to withdraw assets in case of an emergency.

Set Up Fees

Configure how the vault will handle fees:

Fee Receiver: The address that will receive the fees (could be the Manager or another entity).

Fee Percentage: Define the fee percentage, which will be deducted from the vault's earnings (recommended between 0.5% to 2% APR).

Deploy the Vault

Now that all details are configured, you are ready to deploy your vault:

Click on “Deploy”: This will generate a transaction that you need to approve.

Review Transaction Details: Before finalizing, ensure that everything is correct, such as the vault address and gas fees.

Sign the Transaction: Once reviewed, sign the transaction through your wallet to deploy the vault.

✅ Congratulations Your vault is now deployed and ready for interaction.

Interacting with a Vault

Once your vault is deployed, you can start interacting with it:

Access the Vault: Click on the vault you want to interact with to see available options.

Select an Action:
Deposit: Add funds to the vault, which will be automatically invested based on the vault's strategy.

Emergency Withdraw: Withdraw investments from strategies and keep funds idle in the vault. (Only accessible by the Manager or Emergency Manager.)

Withdraw: Withdraw your position (dfTokens) from the vault.

View Vault Information and Add Liquidity

You can view all available vaults along with their details, such as:

Name: The vault’s name.
Address: The vault's blockchain address.
TVL (Total Value Locked): The current total value locked in the vault.
User Balance: Your balance within the vault.
Asset: The asset used in the vault (e.g., XLM, USDC).
👉🏽 To add liquidity, simply select the vault you want to add funds to and make a deposit.

Thank you for using our Defindex dApp on Testnet!

We’d love to hear your feedback and know how we can improve. Please take a moment to fill out this short form, which will only take a few minutes. Your input is incredibly valuable to us and will help us continue to enhance the platform.
📍 https://forms.gle/u8YtuXG2uc3W4jMVA

We look forward to hearing from you!

About PaltaLabs 🥑

PaltaLabs is a pioneering company in decentralized finance and blockchain technology. We specialize in developing decentralized applications and blockchain consulting, simplifying the creation of smart contracts with just a line of code. We are creators, builders, and visionaries dedicated to shaping the future of decentralized technology. Our protocol, Soroswap.Finance 🪐, offers fast and secure transactions on the Stellar network.
Join us and explore new opportunities in the financial world!

🥑 PaltaLabs Website | PaltaLabs Twitter | Discord

Step-by-Step Guide to Perform a Token Swap on Soroswap.Finance

Jenny T. — Tue, 17 Sep 2024 12:48:25 +0000

Here's a detailed, step-by-step guide on how to perform a token swap on Soroswap.Finance, tailored for new users. This guide will walk you through the process, from setting up your wallet to completing the token swap, with helpful tips and essential precautions to ensure a smooth experience.

Follow the steps below to perform a swap:

Step 1: Access Soroswap:

Go to the official soroswap.finance website.

Click the “Launch App” button on the homepage to start interacting with Soroswap’s decentralized platform. This will take you to the swap interface.

Step 2: Connect your wallet with Soroswap.Finance

Choose a Stellar Wallet: Select a wallet compatible with the Stellar network. For further guidance, you can check out this helpful article: Guide to Choosing a Stellar Wallet.

2.Acquire Stellar (XLM): Purchase XLM from a reputable exchange or transfer it from another wallet if you already own some.

3.Deposit XLM into Your Wallet: Transfer the XLM to your new Stellar wallet address

If this is your first time, you will need to acquire Stellar (XLM) and transfer it to your wallet.

Step 3: Navigate the Soroswap Finance Interface

Once your Stellar wallet is connected, familiarize yourself with the Soroswap dashboard. It displays your account details, token balances, and options for swapping tokens and managing your assets.

Step 4: Executing a Token Swap

1.Select Tokens: Choose the tokens you want to swap from and to.

2.Enter Amount: Specify the amount of tokens you want to exchange.

Step 5: Trustlines

When swapping a new token for the first time on Soroswap.Finance, you’ll need to sign a "trustline" transaction. Trustlines authorize your account to hold and exchange a specific asset.

1.Transaction Request: A transaction request is sent to authorize your wallet to hold and trade the new token.

2.Sign the Trustline Transaction: Once the transaction is signed, the trustline is successfully authorized, enabling your wallet to hold and manage the new asset.

For more information, refer to the official documentation on trustlines.

Step 6: Confirming the Transaction

Sign the Transaction: Approve the transaction to finalize the swap.

Congratulations! You have successfully completed a swap on Soroswap.Finance Now.

Step Step 7: Check That Your Transaction Went Through

After signing the transaction, it's important to confirm that everything went smoothly. To do this, check the details in your wallet or by using one of the blockchain explorers. This step ensures that the token swap has been completed and that the new tokens are now visible in your balance.

Once the transaction is confirmed, you’ll see a success message indicating the swap is complete. At this point, you can review the transaction details by selecting one of these options:

View in Stellar.Expert
View in StellarChain

By following this step, you can be sure the swap has successfully processed and that your wallet reflects the correct balance.

Best Practices

Sufficient XLM for Fees: Ensure you have enough XLM in your wallet to cover transaction fees.
Review Trustlines: Confirm that all necessary trustlines are set up before performing a swap.
Check Transaction History: Verify in your wallet that the swap has been completed and the new tokens are reflected in your balance.

This guide aims to provide clear and simple instructions to help you successfully complete your first token swap on Soroswap.Finance. Remember, handling digital assets responsibly is crucial for maintaining the security of your investments.

Official Website: Soroswap.Finance
Twitter: @SoroswapFinance
GitHub: Soroswap
Documentation: docs.soroswap.finance

Guide to Choosing Wallet for the Stellar Network

Jenny T. — Wed, 11 Sep 2024 16:46:22 +0000

Introduction

Before you can start using Soroswap.Finance 🪐, the decentralized exchange on the Soroban blockchain, you'll need to set up a wallet for Stellar Lumens (XLM). A Stellar Lumens wallet is essential for storing and sending XLM. In this article, you'll learn about the importance of a Stellar Lumens wallet, the types available, our recommended choices, and more.

User Interface

Wallets on the Stellar network come in several forms:

Mobile Wallets:
Offer convenience and accessibility. Ideal for users who need access on the go.
Browser Extensions:
Facilitate quick transactions and are easy to integrate with web services.
Desktop Wallets:
Provide robust security features and are suitable for handling larger amounts or for more frequent trading.
Security

Security

Key security features to consider include:

Private Key Management: Ensuring that the wallet gives you full control over your private keys.
Encryption: Strong encryption standards to protect your data.
Backup & Recovery: Options available for backing up and recovering your wallet.

Popular Wallet Options for Stellar

Freighter Wallet

Description: A browser extension wallet designed specifically for the Stellar network.
Key Features: Integrates seamlessly with web applications, supports multiple Stellar accounts.
Recommended Use Cases: Best for users who frequently interact with Stellar-based web applications. Installation Guide: For a step-by-step tutorial on how to install and set up Freighter Wallet.

XBull Wallet

Description: A comprehensive wallet offering both mobile and desktop versions.
Key Features: Support for multiple assets, built-in exchange features, and high-level security measures.
Recommended Use Cases: Suitable for users looking for a versatile wallet that supports frequent trading and investment.

Lobstr Wallet

Description: Popular among Stellar users for its user-friendly mobile app.
Key Features: Social features for sending and receiving payments, strong security protocols.
Recommended Use Cases: Ideal for everyday users needing a simple and secure way to manage and transact with Stellar Lumens and other tokens.

Hana Wallet

Description: Is a mobile wallet known for its simplicity and effectiveness, designed specifically for managing Stellar assets on the go.
Key Features: Minimalistic design, ease of use, focus on user privacy.
Recommended Use Cases: Great for new users of the Stellar network who prefer a straightforward and secure wallet.

Factors to Consider

Security and Privacy

Assess the wallet’s security track record and read reviews about its reliability and privacy protections.

Ease of Use

The wallet interface should be intuitive, making it easy for you to manage your assets and transactions without confusion.

Compatibility

Consider how well the wallet integrates with other platforms and applications, including exchanges and other blockchain services.

Further Research

Before making a final decision, visit official wallet websites, read user reviews, and check out community feedback on forums like Discord or Stellar community channels. Understanding the experiences of other users can provide valuable insights into the reliability and efficiency of a wallet.

Choosing the right Stellar wallet will enhance your experience and ensure that your assets are secure and easily manageable. Take the time to evaluate each option based on these criteria to find the best fit for your needs.