Minecraft Huh TCP1P

Hellow h4ckers. So this is my 4th solve is TCP1P . Well this is a slightly different one. So let’s first go through the challenge description

CHALLENGE DESCRIPTION

Say, everyone knows minecraft right? The game about mining block after block after block after block…..

NOTE! You only need to spawn an instance, no need to press the “Flag” button. The isSolved() function will always return false afterall.

CHANGER.sol

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

contract Changer {

    string public keywords;

    constructor() payable {
        keywords = "thisIsTheFirstOneIsntIt";  
    }

    function changeKeywords(string memory _value) public {
        keywords = _value;
    }

}

Setup.sol

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

import "./Changer.sol";

contract Setup {
    Changer public challengeInstance;

    constructor() payable {
        challengeInstance = new Changer{value: 1 ether}();
    }

    function isSolved() public view returns (bool) {
        return false;
    }

}

The Exploit :

First read the challenge description properly. What does it say?

You only need to spawn an instance, no need to press the “Flag” button. The isSolved() function will always return false afterall.

In this challenge, the author pointed out that you don’t need to hit the flag button to obtain the flag, which suggests that it’s stored somewhere on the blockchain. It could be located in any contract deployed on the blockchain linked to the provided RPC URL, or it might be included in the data of any transaction. Therefore, by examining all the transactions in each block, we may be able to find the flag. This approach leverages the transparency of the blockchain.

First, let’s check the current block number.

cast block-number — rpc-url <rpc url>

This command returned 8, indicating that 8 blocks have been mined. Since we haven’t conducted any transactions, the block number remains unchanged. The transactions in these 8 blocks were executed during the instance creation. The flag is likely embedded in one of those transactions across these blocks.

Now, let’s review each block and its associated transactions.

cast block <block-number> <rpc url>

Now go through every block and also look into their transaction details by using the command

cast tx — rpc-url <rpc url> <transaction hash>

So if you go through every block, you will find the flag in 6th block(Beware of fake flags)

SIMPLE YET IMPORTANT !!