ctf-blockchain - A summary and solutions for 200+ CTF blockchain ch

项目说明

CTF Blockchain Challenges

This repository collects blockchain challenges in CTFs and wargames.

These challenges are categorized by topic, not by difficulty or recommendation.
Some of them include personal writeups and solutions (e.g., Paradigm CTF 2022).
Please be aware that these contain spoilers.

---

Table of Contents

CTF List

Ethereum

- Smart contract basics
- E
- Misuse of tx.origin
- Weak sources of randomness from chain attributes
- ERC-20 basics
- Storage o by delegatecall
- Context mismatch in delegatecall
- Integer o
- Ether transfer failures for non-payable contracts
- Forced Ether transfers to non-payable contracts via selfdestruct
- Large gas consumption by contract callees
- Forgetting to set view/pure to interface and abstract contract functions
- Missing success flag checks in low-le
- view functions that do not always return same
- Mistakes in setting storage and memory
- Tracing transactions
- Re states
- Re transactions
- Re E
- E logic bugs
- E golf
- Jump-oriented programming
- Gas optimization
- Collisions when using abi.encodePacked with length arguments
- Bypassing with zero iteration loops
- Reentrancy attacks
- Flash loan basics
- Go attacks by executing flash loans during snapshots
- Bypassing repayments of push architecture flash loans
- Bugs in AMM price calculation algorithm
- Attacks using custom tokens
- Oracle manipulation attacks without flash loans
- Oracle manipulation attacks with flash loans
- Sandwich attacks
- Reco of private keys by same-nonce attacks
- ECDSA signature malleability attacks
- Brute-forcing addresses
- Reco of public keys
- ecrecover returns address(0) for invalid signatures
- Encryption and decryption in secp256k1
- Bypassing bots and taking ERC-20 tokens owned by wallets with known private keys
- Claimable intermediate nodes of Merkle trees
- Precompiled contracts
- Faking errors
- Foundry cheatcodes
- Front-running
- Back-running
- EIP-7702
- Head o bugs in calldata tuple ABI-reencoding (\< Solidity 0.8.16)
- O storage slots storage (\< Solidity 0.8.1)
- O arbitrary storage slots by setting array lengths to 2^256-1 (\< Solidity 0.6.0)
- Constructors that is just functions by typos (\< Solidity 0.5.0)
- O storage slots storage pointer (\< Solidity 0.5.0)
- Other ad-hoc and methods

Bitcoin

- Bitcoin basics
- Reco of private keys by same-nonce attacks
- Bypassing PoW of other applications using Bitcoin's PoW database

Solana

Cosmos

- CosmWasm
- Application-specific blockchain

Move

Cairo

Other Blockchain-Related

---

CTF List

🔗: External link

Always-on CTFs / Practice CTFs

| CTF Name | Note |
| ----------------------------------------------------------------------------- | --------------------------- |
| Ethernaut | |
| Damn DeFi 🔗 | |
| f's E | |
| Dreamhack 🔗 | |
| Hack The Box 🔗 | |
| Capture the Ether | |
| Oak Security CosmWasm CTF | |
| Cipher Shastra 🔗 | |
| ONLYPWNER 🔗 | No solution sharing allowed |

Scheduled CTFs

| CTF Name | Event Month |
| -------------------------------------------------------------------------------------------------------------------------- | -------------------- |
| COMPFEST CTF 2025 | 2025-10 |
| ImaginaryCTF 2025 🔗 | 2025-09 |
| corCTF 2025 🔗 | 2025-08 |
| Full Weak Engineer CTF | 2025-08 |
| HITCON CTF 2025 | 2025-08 |
| SekaiCTF 2025 🔗 | 2025-08 |
| justCTF 2025 🔗 | 2025-08 |
| smileyCTF 2025 | 2025-06 |
| Hack The Box: Global Cyber Skills Benchmark CTF 2025 🔗 | 2025-05 |
| DiceCTF 2025 Quals | 2025-03 |
| Hack The Box: Cyber Apocalypse CTF 2025 🔗 | 2025-03 |
| Remedy CTF 2025 🔗 | 2025-01 |
| Hack The Box: Uni CTF 2024 🔗 | 2024-12 |
| SECCON CTF 13 Quals | 2024-11 |
| SCAN 2024 CTF | 2024-10 |
| BlazCTF 2024 | 2024-09 |
| The Flare-On Challenge 11 | 2024-09 |
| SekaiCTF 2024 | 2024-08 |
| Wintermute Alpha Challenge 🔗 | 2024-08 |
| corCTF2024 | 2024-07 |
| HITCON CTF 2024 Quals | 2024-07 |
| SECCON Beginners CTF 2024 | 2024-06 |
| Hack The Box: HTB Business CTF 2024 🔗 | 2024-03 |
| osu!gaming CTF 2024 | 2024-03 |
| Hack The Box: Cyber Apocalypse 2024 🔗 | 2024-03 |
| DiceCTF 2024 Quals | 2024-02 |
| LA CTF 2024 | 2024-02 |
| BlazCTF 2023 | 2023-12 |
| Paradigm CTF 2023 | 2023-10 |
| MetaTrust Web3 Security CTF | 2023-09 |
| SECCON CTF 2023 Quals | 2023-09 |
| ME CTF | 2023-08 |
| SekaiCTF 2023 | 2023-08 |
| corCTF 2023 | 2023-07 |
| SEETF 2023 | 2023-06 |
| NumenCTF | 2023-03 |
| EKOPARTY CTF 2022 | 2022-11 |
| N1CTF 2022 | 2022-11 |
| SekaiCTF 2022 | 2022-10 |
| 0CTF/TCTF 2022 | 2022-09 |
| Balsn CTF 2022 | 2022-09 |
| DownUnderCTF 2022 | 2022-09 |
| DeFi-Security-Summit-Stanford | 2022-08 |
| MapleCTF 2022 | 2022-08 |
| Paradigm CTF 2022 | 2022-08 |
| TJCTF 2022 🔗 | 2022-05 |
| ALLES! CTF 2021 🔗 | 2021-09 |
| Paradigm CTF 2021 | 2021-02 |
| 0x41414141 CTF | 2021-01 |
| DarkCTF | 2020-09 |
| Curta | Occasional, Inactive |
| EthernautDAO | Occasional, Inactive |
| HuffChallenge | Occasional, Inactive |
| QuillCTF | Occasional, Inactive |

---

Ethereum

Note:

If an attack is only valid for a particular of Solidity and not for the latest , the is noted at the end of the heading.

To avoid notation fluctuations, E are a as much as possible and Solidity terms are used.

Smart contract basics

These challenges can be solved if you know the basic mechanics of Ethereum, the basic language specification of Solidity, and the basic operation of contracts.

| Challenge | Note, Keywords |
| ------------------------------------------------------------------ | ---------------------- |
| Capture The Ether: Deploy a contract | faucet, wallet |
| Capture The Ether: Call me | contract call |
| Capture The Ether: Choose a nickname | contract call |
| Capture The Ether: Guess the number | contract call |
| Capture The Ether: Guess the secret number | keccak256 |
| Ethernaut: 0. Hello Ethernaut | contract call, ABI |
| Ethernaut: 1. Fallback | recei function |
| Paradigm CTF 2021: Hello | contract call |
| 0x41414141 CTF: sanity-check | contract call |
| Paradigm CTF 2022: RANDOM | contract call |
| DownUnderCTF 2022: Solve Me | |
| LA CTF 2024: remi's-world | |

E

Puzzle challenges that can be solved by understanding the E.

No are used to sol challenges.

| Challenge | Note, Keywords |
| ------------------------------------------------------------------ | ---------------------------------------------------------------------- |
| Capture The Ether: Guess the new number | block.number, block.timestamp |
| Capture The Ether: Predict the block hash | blockhash |
| Ethernaut: 13. Gatekeeper One | msg.sender != tx.origin, gasleft().mod(8191) == 0, type con |
| Ethernaut: 14. Gatekeeper Two | msg.sender != tx.origin, extcodesize is 0 |
| Cipher Shastra: Minion | msg.sender != tx.origin, extcodesize is 0, block.timestamp |
| SECCON Beginners CTF 2020: C4B | block.number |
| Paradigm CTF 2021: Babysandbox | staticcall, call, delegatecall, extcodesize is 0 |
| Paradigm CTF 2021: Lockbox | ecrecover, abi.encodePacked, msg.data.length |
| EthernautDAO: 6. (No Name) | block.number, gas price war |
| f's E | |
| Huff Challenge: Challenge #3 | |
| Paradigm CTF 2022: LOCKBOX2 | |
| Paradigm CTF 2022: SOURCECODE | quine |
| Numen Cyber CTF 2023: LittleMoney | function pointer |
| Numen Cyber CTF 2023: ASSLOT | staticcall that return different |
| Paradigm CTF 2023: Black Sheep | Huff |

Misuse of tx.origin

tx.origin refers to the address of the transaction publisher and should not be used as the address of the contract caller msg.sender.

| Challenge | Note, Keywords |
| ----------------------------------------- | -------------- |
| Ethernaut: 4. Telephone | |

Weak sources of randomness from chain attributes

Since contract bytecodes are publicly a, it is easy to predict pseudorandom numbers whose generation is completed on-chain (using only states, not off-chain data).

It is equi to having all the parameters of a pseudorandom number generator exposed.

If you want to use random numbers that are unpredictable to anyone, use a decentralized oracle with a random number function.

- For example, Chainlink VRF, which implements Random Function (VRF).

| Challenge | Note, Keywords |
| ------------------------------------------------------------- | -------------- |
| Capture The Ether: Predict the future | |
| Ethernaut: 3. Coin Flip | |
| DownUnderCTF 2022: Crypto Casino | |
| Paradigm CTF 2023: SkillBasedGame | |

ERC-20 basics

These challenges can be solved with an understanding of the ERC-20 token standard.

| Challenge | Note, Keywords |
| ------------------------------------------------------------------------ | ------------------------------------- |
| Ethernaut: 15. Naught Coin | transfer, approve, transferFrom |
| Paradigm CTF 2021: Secure | WETH |
| DeFi-Security-Summit-Stanford: | |

Storage o by delegatecall

delegatecall is a potential source of because the storage of the delegatecall caller contract can be o by the called contract.

| Challenge | Note, Keywords |
| -------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------- |
| Ethernaut: 6. Delegation | |
| Ethernaut: 16. Preser | |
| Ethernaut: 24. Puzzle Wallet | proxy contract |
| Ethernaut: 25. Motorbike | proxy contract, EIP-1967: Standard Proxy Storage Slots |
| DeFi-Security-Summit-Stanford: InSecureumLenderPool | flash loan |
| QuillCTF2023: D3l3g4t3 | |
| Numen Cyber CTF 2023: Counter | writing EVM code |

Context mismatch in delegatecall

Contracts called by delegatecall are executed in the context of the delegatecall caller contract.

If the function does not carefully consider the context, a bug will be created.

| Challenge | Note, Keywords |
| --------------------------------------------------------- | -------------------------- |
| EthernautDAO: 3. CarMarket | Non-use of address(this) |

Integer o

For example, subtracting 1 from the value of a of uint type when the value is 0 causes an arithmetic o.

Arithmetic o has been detected and re state since Solidity v0.8.0.

Contracts written in earlier can be checked by using the SafeMath library.

| Challenge | Note, Keywords |
| ------------------------------------------------------ | -------------- |
| Capture The Ether: Token sale | multiplication |
| Capture The Ether: Token whale | subtraction |
| Ethernaut: 5. Token | subtraction |

Ether transfer failures for non-payable contracts

Do not create a contract on the assumption that normal Ether transfer (.send() or .transfer()) can always be executed.

If a destination is a contract and there is no recei function or payable fallback function, Ether cannot be transferred.

However, instead of the normal transfer functions, the selfdestruct described in the next section can be used to force such a contract to transfer Ether.

| Challenge | Note, Keywords |
| ----------------------------------------------------------------- | -------------- |
| Ethernaut: 9. King | |
| SekaiCTF 2022: Random Song | Chainlink VRF |

Forced Ether transfers to non-payable contracts via selfdestruct

If a contract does not have a recei function and a payable fallback function, it is not guaranteed that Ether will not be received.

When a contract executes selfdestruct, it can transfer its Ether to another contract or EOA, and this selfdestruct transfer can be forced even if the destination contract does not have the recei function and the payable fallback function.

If the application is built on the assumption that the Ether is 0, it could be a bug.

| Challenge | Note, Keywords |
| ---------------------------------------------------------- | ---------------- |
| Capture The Ether: Retirement fund | integer o |
| Ethernaut: 7. Force | |

Large gas consumption by contract callees

A large amount of gas can be consumed by loops and recursion in call, and there may not be enough gas for the rest of the process.

Until Solidity v0.8.0, zero di and assert(false) could consume a lot of gas.

| Challenge | Note, Keywords |
| --------------------------------------- | -------------- |
| Ethernaut: 20. Denial | |

Forgetting to set view/pure to interface and abstract contract functions

If you forget to set view or pure for a function and design your application under the assumption that the state will not change, it will be a bug.

| Challenge | Note, Keywords |
| ----------------------------------------- | -------------- |
| Ethernaut: 11. Elevator | interface |

Missing success flag checks in low-le

If a contract performs low-le (such as call, delegatecall, or staticcall) without checking the returned success flag, it may mistakenly assume the call succeeded, potentially leading to .

| Challenge | Note, Keywords |
| -------------------------------------- | -------------- |
| Ethernaut: 31. Stake | |

view functions that do not always return same

Since view functions can read state, they can be conditionally branched based on state and do not necessarily return the same value.

| Challenge | Note, Keywords |
| ------------------------------------- | -------------- |
| Ethernaut: 21. Shop | |

Mistakes in setting storage and memory

If storage and memory are not set properly, old may be referenced, or o may not occur, resulting in .

| Challenge | Note, Keywords |
| -------------------- | --------------------------------------------------------------------------------------------------------------- |
| N1CTF 2021: BabyDefi | Co infinite minting + flash loan |

Tracing transactions

information can be obtained just by following the flow of transaction processing.

Blockchain explorers such as Etherscan are useful.

| Challenge | Note, Keywords |
| ----------------------------------------- | --------------------------------- |
| Ethernaut: 17. Recovery | loss of deployed contract address |

Re states

Since the state and the bytecodes of contracts are public, all , including private , are readable.

Private are only guaranteed not to be directly readable by other contracts, but we, as an entity outside the blockchain, can read them.

| Challenge | Note, Keywords |
| ------------------------------------------------------------------ | -------------- |
| Capture The Ether: Guess the random number | |
| Ethernaut: 8. Vault | |
| Ethernaut: 12. Privacy | |
| Cipher Shastra: Sherlock | |
| 0x41414141 CTF: secure enclave | log, storage |
| EthernautDAO: 1. Pri | |

Re transactions

Re the contents of a transaction or how the state has been changed by the transaction.

| Challenge | Note, Keywords |
| ---------------------------------------------------------------- | -------------- |
| darkCTF: Secret Of The Contract | |
| DownUnderCTF 2022: Secret and Ephemeral | |

Re E

Re a contract for which code is not given in whole or in part.

e is very useful.

Use a decompiler (e.g., Dedaub Decompiler, heimdall).

Use a disassembler (e.g., ByteGraph, ethersplay).

Use a debugger (e.g., Foundry Debugger).

| Challenge | Note, Keywords |
| ------------------------------------------------------------------------------------ | --------------------------------------- |
| Incognito 2.0: Ez | keep in plain text |
| 0x41414141 CTF: crackme.sol | decompile |
| 0x41414141 CTF: Crypto Casino | bypass condition check |
| Paradigm CTF 2021: Babyrev | |
| 34C3 CTF: Chaingang | |
| Blaze CTF 2018: Smart? Contract | |
| DEF CON CTF Qualifier 2018: SAG? | |
| pbctf 2020: pbcoin | |
| Paradigm CTF 2022: STEALING-SATS | |
| Paradigm CTF 2022: ELECTRIC-SHEEP | |
| Paradigm CTF 2022: FUN-RE | |
| DownUnderCTF 2022: E Mechanism | |
| EKOPARTY CTF 2022: Byte | stack tracing |
| EKOPARTY CTF 2022: SmartRev | memory tracing |
| Numen Cyber CTF 2023: HEXP | previous block hash == gas price % 2^24 |
| BlazCTF 2023: Maze | |
| BlazCTF 2023: Jambo | |
| BlazCTF 2023: Ghost | |
| Curta: Lana | LLVM |
| Ethernaut: 30. HigherOrder | calldata |
| COMPFEST CTF 2025: Synthetic Manipulation | |

E logic bugs

Logic bugs in assemblies such as Yul

| Challenge | Note, Keywords |
| ---------------------------------------------- | -------------- |
| SekaiCTF 2024: Zoo | Pausable |

E golf

These challenges have a limit on the length of the bytecode to be created.

| Challenge | Note, Keywords |
| ------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------- |
| Ethernaut: 18. MagicNumber | |
| Paradigm CTF 2021: Rever | Palindrome detection. In addition, the code that inverts the bytecode must also be able to detect palindromes. |
| Huff Challenge: Challenge #1 | |

Jump-oriented programming

Jump-Oriented Programming (JOP)

| Challenge | Note, Keywords |
| ---------------------------------------------------------------------------------- | -------------- |
| SECCON CTF 2023 Quals: Tokyo Payload | |
| Paradigm CTF 2021: JOP | |
| Real World CTF 3rd: Re:Montagy | |

Gas optimization

These challenges have a limit on the gas to be consumed.

| Challenge | Note, Keywords |
| -------------------------------------------------- | -------------- |
| Huff Challenge: Challenge #2 | |

Collisions when using abi.encodePacked with length arguments

| Challenge | Note, Keywords |
| ---------------------------------------------------------------- | -------------- |
| SEETF 2023: Operation Feathered Fortune Fiasco | |

Bypassing with zero iteration loops

| Challenge | Note, Keywords |
| ------------------------------------------- | -------------------------- |
| SEETF 2023: Murky SEEPass | array length, Merkle proof |

Reentrancy attacks

In case a function of contract A contains interaction with another contract B or Ether transfer to B, the control is temporarily transferred to B.

Since B can call A in this control, it will be a bug if the design is based on the assumption that A is not called in the middle of the execution of that function.

For example, when B executes the withdraw function to withdraw Ether deposited in A, the Ether transfer triggers a control shift to B, and during the withdraw function, B executes A's withdraw function again. Even if the withdraw function is designed to prevent withdrawal of more than the limit if it is simply called twice, if the withdraw function is executed in the middle of the withdraw function, it may be designed to bypass the limit check.

To prevent reentrancy attacks, use the Checks-Effects-Interactions pattern.

| Challenge | Note, Keywords |
| ------------------------------------------------------------------------------- | -------------------------- |
| Capture The Ether: Token bank | ERC-223, tokenFallback() |
| Ethernaut: 10. Re-entrancy | call |
| Paradigm CTF 2021: Yield Aggregator | |
| HTB Uni CTF 2020 Quals: moneyHeist | |
| EthernautDAO: 4. | call |
| DeFi-Security-Summit-Stanford: InsecureDexLP | ERC-223, tokenFallback() |
| MapleCTF 2022: maplebacoin | |
| QuillCTF 2022: SafeNFT | ERC721, _safeMint() |
| Numen Cyber CTF 2023: SimpleCall | call |
| SEETF 2023: PigeonBank | |
| SekaiCTF 2023: Re-Remix | Read-Only Reentrancy |
| SECCON Beginners CTF 2024: | ERC721, _safeMint() |
| Full Weak Engineer CTF: Save the Kappa | |

Flash loan basics

Flash loans are uncollateralized loans that allow the borrowing of an asset, as long as the borrowed assets are returned before the end of the transaction. The borrower can deal with the borrowed assets any way they want within the transaction.

By making large asset moves, attacks can be made to snatch funds from DeFi applications or to gain large amounts of votes for participation in go.

A solution to attacks that use flash loans to corrupt oracle is to use a decentralized oracle.

| Challenge | Note, Keywords |
| -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Damn DeFi: 1. Unstoppable | Simple flash loan with a single token. Failure to send the token directly. |
| Damn DeFi: 2. Nai | The flashLoan function can specify a borrower, but the receiver side does not authenticate the TX sender, so the receiver's funds can be drained as a fee |
| Damn DeFi: 3. Truster | The target of a call is made into the token and the token can be taken by approving it to oneself |
| Damn DeFi: 4. Sideentrance | Flash loan that allows each user to make a deposit and a withdrawal. The deposit can be executed at no cost at the time of the flash loan. |

Go attacks by executing flash loans during snapshots

If the algorithm distributes some kind of rights using the token balance at the time of a snapshot, and if a malicious user transaction can trigger a snapshot, a flash loan can be used to obtain massi.

A period of time to lock the token will avoid this attack.

| Challenge | Note, Keywords |
| ------------------------------------ | -------------------------------------------------------------------- |
| Damn DeFi: 5. Therewarder | Get reward tokens based on the deposited token balance. |
| Damn DeFi: 6. Selfie | Get power in go based on the deposited token balance. |

Bypassing repayments of push architecture flash loans

There are two architectures of flash loans: push and pull, with push architectures represented by Uniswap and Aave v1 and pull architectures by Aave v2 and dYdX.

The proposed flash loan in EIP-3156: Flash Loans is a pull architecture.

| Challenge | Note, Keywords |
| -------------------------- | --------------------------------------------------------------- |
| Paradigm CTF 2021: Upgrade | Bypass using the lending functionality implemented in the token |

Bugs in AMM price calculation algorithm

A bug in the Automated Market Maker (AMM) price calculation algorithm allows a simple combination of trades to drain funds.

| Challenge | Note, Keywords |
| ------------------------------------ | -------------- |
| Ethernaut: 22. Dex | |

Attacks using custom tokens

The ability of a protocol to use arbitrary tokens is not in itself a bad thing, but it can be an attack .

In addition, bugs in the whitelist design, which assumes that arbitrary tokens are not a, could cause funds to drain.

| Challenge | Note, Keywords |
| ---------------------------------------- | -------------- |
| Ethernaut: 23. Dex Two | |

Oracle manipulation attacks without flash loans

It corrupts the value of the oracle and drains the funds of applications that refer to that oracle.

| Challenge | Note, Keywords |
| ------------------------------------ | ----------------------------------------------------------------------------------------------- |
| Paradigm CTF 2021: Broker | Distort Uniswap prices and liquidate positions on lending platforms that reference those prices |
| Damn DeFi: 7. Compromised | Off-chain private key leak & oracle manipulation |

Oracle manipulation attacks with flash loans

The use of flash loans distorts the value of the oracle and drains the funds of the protocols that reference that oracle.

The ability to mo amounts of funds through a flash loan makes it easy to distort the oracle and cause more damage.

| Challenge | Note, Keywords |
| -------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------- |
| Damn DeFi: 8. Puppet | Distort the price of Uniswap V1 and leak tokens from a lending platform that references that price |
| DeFi-Security-Summit-Stanford: BorrowSystemInsecureOracle | lending protocol |

Sandwich attacks

For example, if there is a transaction by another party to sell token A and buy B, the attacker can put in a transaction to sell A and buy B before the transaction, and later put in a transaction to sell the same amount of B and buy A, thereby ultimately increasing the amount of A at a profit.

In general, such "revenue earned by selecting, inserting, and reordering transactions contained in a block generated by a miner" is referred to as Miner Extractable Value (ME, it is also called Maximal Extractable Value.

| Challenge | Note, Keywords |
| ------------------------------------------------- | ------------------------------------------- |
| Paradigm CTF 2021: Farmer | Sandwich the trade from COMP to WETH to DAI |

Reco of private keys by same-nonce attacks

In general, a same-nonce attack is possible when the same nonce is used for different messages in the elliptic curve DSA (ECDSA), and the secret key can be calculated.

In Ethereum, if nonces used to sign transactions are the same, this attack is feasible.

| Challenge | Note, Keywords |
| ----------------------------------------------------------- | -------------- |
| Capture The Ether: Account Takeover | |
| Paradigm CTF 2021: Babycrypto | |
| MetaTrust CTF: ECDSA | |

ECDSA signature malleability attacks

ECDSA signatures have a property called malleability, where for a gi and signature (v, r, s), there exists another valid signature (v', r, -s mod n) for the same message.

This can be exploited in systems that track used signatures, as the alternati may not be recognized as already used.

In Ethereum's secp256k1 curve, this property can be used to bypass signature mechanisms.

| Challenge | Note, Keywords |
| ---------------------------------------------------------------------- | ---------------------------------------- |
| SmileyCTF: MultisigWallet | ECDSA, signature malleability, secp256k1 |
| COMPFEST CTF 2025: snake_inception | Vyper |

Brute-forcing addresses

Brute force can make a part of an address a specific value.

| Challenge | Note, Keywords |
| --------------------------------------------------------- | ---------------- |
| Capture The Ether: Fuzzy identity | 28 bits, CREATE2 |
| Numen Cyber CTF 2023: Exist | 16 bits |

Reco of public keys

The address is the public key applied to a keccak256 hash, and the public key cannot be recovered from the address.

If even one transaction has been sent, the public key can be back-calculated from it.

Specifically, it can be recovered from the Recursi Prefix (RLP)-encoded data [nonce, gas_price, gas, to, value, data, chain_id, 0, 0] and the signature (v,r,s).

| Challenge | Note, Keywords |
| ----------------------------------------------------- | -------------- |
| Capture The Ether: Public Key | RLP, ECDSA |

ecrecover returns address(0) for invalid signatures

The ecrecover precompile returns address(0) when the signature is invalid or malformed.

This behavior can be exploited if contracts don't properly the return value of ecrecover.

| Challenge | Note, Keywords |
| ------------------------------------------------------------------ | -------------- |
| SekaiCTF 2024: Play to Earn | Burn |

Encryption and decryption in secp256k1

| Challenge | Note, Keywords |
| ----------------------------------------------- | --------------- |
| 0x41414141 CTF: Rich Club | DEX, flash loan |

Bypassing bots and taking ERC-20 tokens owned by wallets with known private keys

If a wallet with a known private key has an ERC-20 token but no Ether, it is usually necessary to first send Ether to the wallet and then transfer the ERC-20 token to get the ERC-20 token.

However, if a bot that immediately takes the Ether sent at this time is running, the Ether will be stolen when the Ether is simply sent.

In this situation, we can use Flashbots bundled transactions or just permit and transferFrom if the token is EIP-2612 permit friendly.

| Challenge | Note, Keywords |
| ------------------------------------------------------------------------- | -------------- |
| EthernautDAO: 5. EthernautDaoToken | |

Claimable intermediate nodes of Merkle trees

| Challenge | Note, Keywords |
| ----------------------------------------------------- | -------------- |
| Paradigm CTF 2022: MERKLEDROP | |

Precompiled contracts

| Challenge | Note, Keywords |
| ------------------------------------------------- | -------------- |
| Paradigm CTF 2022: | |

Faking errors

| Challenge | Note, Keywords |
| ----------------------------------------------- | -------------- |
| Ethernaut: 27. Good Samaritan | |

Foundry cheatcodes

| Challenge | Note, Keywords |
| ---------------------------------------------------- | -------------- |
| Paradigm CTF 2022: TRAPDOOOR | |
| Paradigm CTF 2022: TRAPDOOOOR | |

Front-running

| Challenge | Note, Keywords |
| ------------------------------------------------------- | -------------- |
| DownUnderCTF 2022: Private Log | |
| DiceCTF 2024: Floordrop | Geth |

Back-running

ME can be used to create bundled transactions to back-run.

| Challenge | Note, Keywords |
| ------------------------------------------------------------------- | -------------- |
| ME CTF: Me 1 | |
| ME CTF: Me 2 | |
| ME CTF: Me 3 | |
| ME CTF: Me 4 | |
| ME CTF: Me | |
| ME CTF: Me | |
| ME CTF: Me | |
| ME CTF: Me (Address) | |
| ME CTF: Me (Salt) | CREATE2 |

EIP-7702

| Challenge | Note, Keywords |
| --------------------------------------------------------------------------------------------------------------------------------------------------- | -------------- |
| HITCON CTF 2025: Maximal Extractable Vuln | |
| COMPFEST CTF 2025: snake_inception | Vyper |

Head o bugs in calldata tuple ABI-reencoding (< Solidity 0.8.16)

See:

| Challenge | Note, Keywords |
| --------------------------------------------------------- | -------------------------- |
| 0CTF 2022: TCTF NFT Market | |
| Numen Cyber CTF 2023: Wallet | illegal v in ecrecover |

O storage slots storage (< Solidity 0.8.1)

In Foo storage foo;, the local foo points to slot 0.

| Challenge | Note, Keywords |
| --------------------------------------------------- | -------------- |
| Capture The Ether: Donation | |

O arbitrary storage slots by setting array lengths to 2^256-1 (< Solidity 0.6.0)

For example, any storage can be o by negatively arithmetic o the length of an array to 2^256-1.

It need not be due to o.

The length property has been read-only since v0.6.0.

| Challenge | Note, Keywords |
| -------------------------------------------------- | -------------- |
| Capture The Ether: Mapping | |
| Ethernaut: 19. Alien Codex | |
| Paradigm CTF 2021: Bank | |

Constructors that is just functions by typos (< Solidity 0.5.0)

In before v0.4.22, the constructor is defined as a function with the same name as the contract, so a typo of the constructor name could cause it to become just a function, resulting in a bug.

Since v0.5.0, this specification is removed and the constructor keyword must be used.

| Challenge | Note, Keywords |
| ----------------------------------------------------------- | -------------- |
| Capture The Ether: Assume ownership | |
| Ethernaut: 2. Fallout | |

O storage slots storage pointer (< Solidity 0.5.0)

Since v0.5.0, uninitialized storage are forbidden, so this bug cannot occur.

| Challenge | Note, Keywords |
| ------------------------------------------------------ | ----------------------------------------------------------------------------------- |
| Capture The Ether: Fifty years | |
| ~~Ethernaut: Locked~~ | deleted |

Other ad-hoc and methods

| Challenge | Note, Keywords |
| ----------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- |
| Paradigm CTF 2021: Bouncer | The funds required for batch processing are the same as for single processing. |
| Paradigm CTF 2021: Market | Make the value of one field be recognized as the value of another field by using key misalignment in the Eternal Storage pattern. |
| EthernautDAO: 2. WalletLibrary | m and n of m-of-n multisig wallet can be changed. |
| Paradigm CTF 2022: RESCUE | |
| Paradigm CTF 2022: JUST-IN-TIME | |
| Paradigm CTF 2022: 0XMONACO | |
| BalsnCTF 2022: NFT Marketplace | initialize, _safeTransferFrom, CREATE2 |
| Numen Cyber CTF 2023: LenderPool | flash loan |
| Numen Cyber CTF 2023: GOATFinance | check sum address |
| SEETF 2023: Pigeon Vault | EIP-2535: Diamonds, Multi-Facet Proxy |
| corCTF 2023: baby-wallet | missing from != to check |

Bitcoin

Note

This section includes challenges of Bitcoin whose transaction model is Unspent Transaction Output (UTXO).

Bitcoin basics

| Challenge | Note, Keywords |
| -------------------------------------- | --------------------------- |
| TsukuCTF 2021: genesis | genesis block |
| WORMCON 0x01: What's My Wallet Address | Bitcoin address, RIPEMD-160 |

Reco of private keys by same-nonce attacks

There was a bug and it has been fixed using RFC6979.

| Challenge | Note, Keywords |
| ----------------------------------------- | -------------- |
| darkCTF: Duplicacy Within | |

Bypassing PoW of other applications using Bitcoin's PoW database

Bitcoin uses a series of leading zeros in the SHA-256 hash value as a Proof of Work (PoW), but if other applications are designed in the same way, its PoW time can be significantly reduced by choosing one that matches the conditions from Bitcoin's past PoW results

| Challenge | Note, Keywords |
| --------------------------- | -------------- |
| Dragon CTF 2020: Bit Flip 2 | 64-bit PoW |

Solana

| Challenge | Note, Keywords |
| ----------------------------------------------------- | -------------------- |
| ALLES! CTF 2021: Secret Store | solana,spl-token |
| ALLES! CTF 2021: Legit Bank | |
| ALLES! CTF 2021: Bugchain | |
| ALLES! CTF 2021: eBPF | re eBPF |
| Paradigm CTF 2022: OTTERWORLD | |
| Paradigm CTF 2022: OTTERSWAP | |
| Paradigm CTF 2022: POOL | |
| Paradigm CTF 2022: SOLHANA-1 | |
| Paradigm CTF 2022: SOLHANA-2 | |
| Paradigm CTF 2022: SOLHANA-3 | |
| corCTF 2023: tribunal | |
| SekaiCTF 2023: The Bidding | |
| SekaiCTF 2023: Play for Free | |

Cosmos

CosmWasm

| Challenge | Note, Keywords |
| ------------------------------------------------------------------------------------- | ----------------------------- |
| Oak Security CosmWasm CTF: 1. Mjolnir | logic bug |
| Oak Security CosmWasm CTF: 2. Gungnir | integer o |
| Oak Security CosmWasm CTF: 3. Lae | address , uppercase |
| Oak Security CosmWasm CTF: 4. Gram | in, rounding error |
| Oak Security CosmWasm CTF: 5. Draupnir | missing return |
| Oak Security CosmWasm CTF: 6. Hofund | flash loan, go |
| Oak Security CosmWasm CTF: 7. Tyrfing | storage collision |
| Oak Security CosmWasm CTF: 8. Gjallarhorn | |
| Oak Security CosmWasm CTF: 9. Brisingamen | |
| Oak Security CosmWasm CTF: 10. Mistilteinn | |

Application-specific blockchain

| Challenge | Note, Keywords |
| ----------------------------------- | -------------- |
| RealWorld CTF 3rd Finals: Billboard | |

Move

| Challenge | Note, Keywords |
| --------------------------------------------------------------------------------- | ---------------------------------------- |
| Numen Cyber CTF 2023: Move to Checkin | contract call in Sui |
| Numen Cyber CTF 2023: ChatGPT tell me where is the | OSINT |
| Numen Cyber CTF 2023: Move to Crackme | re Move code and Linux executable |
| justCTF 2024 teaser: The Otter Scrolls | |
| justCTF 2024 teaser: Dark BrOTTERhood | |
| justCTF 2024 teaser: World of Ottercraft | |

Cairo

| Challenge | Note, Keywords |
| --------------------------------------------------------------- | ---------------- |
| Paradigm CTF 2022: RIDDLE-OF-THE-SPHINX | contract call |
| Paradigm CTF 2022: CAIRO-PROXY | integer o |
| Paradigm CTF 2022: CAIRO-AUCTION | Uint256 |
| BalsnCTF 2022: Cairo Reverse | re |

Other Blockchain-Related

Things that are not directly related to blockchains but are part of the ecosystems.

| Challenge | Note, Keywords |
| -------------------------------------- | --------------------------------- |
| TsukuCTF 2021: InterPlanetary Protocol | IPFS address, Base32 in lowercase |

项目信息

开发语言：Solidity

Star 数：1100

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A summary and solutions for 200+ CTF blockchain challenges展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。