C 603: Capture the Ether: Guess the Number (15 pts.)

What You Need

Purpose

To learn Solidity hacking.

Preparation

You should already have the MetaMask browser extension, some Ropsten test Eth, and have completed the first Capture The Ether challenge.

Guess the Number

In your browser, go to: https://capturetheether.com/challenges/lotteries/guess-the-number/

You see the "Guess the number" page, as shown below.

Read the Solidity code. Notice these things:

Testing the Contract with a Simulated Blockchain

Before risking our Ether on the real public blockchain, let's test our strategy on a local simluated blockchain.

Using Remix

You should already have a Remix tab open. If you don't, open a new browser tab and go to

http://remix.ethereum.org/

Pasting in the Solidity Code

On the left side, in the FILE EXPLORERS pane, click the "File explorers" icon, outlined in green in the image below.

Right-click the contracts folder and click "New File".

Name the new file guess.sol

Paste in the code from the "Guess the number" page, as shown below.

On the left side of the Remix page, click the Compile icon, outlined in red in the image above.

Click the "Compile guess.sol" button.

Then click the Deploy icon, outlined in light blue in the image above.

Deploying the Contract on the JavaScript VM

In the Remix page, on the left, in the "DEPLOY & RUN TRANSACTIONS" pane, set the ENVIRONMENT to "JavaScript VM (London)", outlined in green in the image below.

In the ACCOUNT box, you can see that your account balance isf 100 Ether, outlined in red in the image below.

In the Remix page, in the lower portion of the "DEPLOY & RUN TRANSACTIONS" pane, click the red Deploy button.

The lower right pane shows a red X icon, indicating that the transaction failed, as shown in the image above.

Why did the transaction fail? Look at the contract code outlined in yellow in the image above.

This is the constructor--the function that creates the contract. It requires a payment of 1 Ether. You didn't pay the required fee.

In the "DEPLOY & RUN TRANSACTIONS" pane, near the top, change the VALUE to "1 Ether", outlined in green in the image below.

Click the red Deploy button.

Your account balance falls to just below 99 Ether, outlined in light blue in the image below.

The lower right pane shows a green check mark, indicating that the transaction succeeded.

At the bottom of the "DEPLOY & RUN TRANSACTIONS" pane, the deployed GUESSTHENUMBERCHALLENGE contract appears, outlined in yellow in the image below.

Calling the guess Function

In the Remix page, at the bottom of the "DEPLOY & RUN TRANSACTIONS" pane, expand the "GUESSTHENUMBERCHALLENGE AT ..." container by clicking the little down-arrow outlined in green in the image below.

In the field next to the red guess button, enter 1, as outlined in red in the image below. This is a deliberately incorrect guess.

Look at the code outlined in yellow in the image below. Calling the guess function costs 1 Ether, but if your guess is correct, you'll get 2 Ether back.

In the "DEPLOY & RUN TRANSACTIONS" pane, near the top, change the VALUE to "1 Ether", outlined in light blue in the image below.

Click the red guess button.

The transaction succeeds, showing a green check mark in the lower right pane, as shown in the image below.

Your account balance falls to just below 98 Ether, outlined in light purple in the image below. You paid the fee, but did not get any Ether back because the guess was incorrect.

Making a Correct Guess

Look at the code outlined in yellow in the image below. You can see that the correct answer is 42.

In the field next to the red guess button, enter 42, as outlined in red in the image below.

In the "DEPLOY & RUN TRANSACTIONS" pane, near the top, change the VALUE to "1 Ether", outlined in light blue in the image below.

Click the red guess button.

The transaction succeeds, showing a green check mark in the lower right pane, as shown in the image below.

Your account balance rises to just below 99 Ether, outlined in light purple in the image below. You paid a fee of 1 Ether, and got 2 Ether back because the guess was correct.

Deploying the Contract on the Ropsten Test Network

On the "Guess the number" page, on the left side, click the "Begin Challenge" button.

A MetaMask box pops up.

Notice that the Total amount being sent is a little more than 1 Eth, outlined in red in the image below.

Click Confirm.

After a few seconds, the left side of the page shows your contract's address, as shown below.

In your browser's address bar, on the right side, click the MetaMask icon. If the MetaMask icon is not visible, click the Extension icon first, outlined in green in the image above.

Notice that your balance has fallen by 1 ETH, and that the latest transaction, shown at the bottom of the MetaMask window, shows a payment of -1 ETH.

You paid 1 ETH to deploy the contract.

Using Remix to Interact with the Deployed Contract

In the Remix page, on the left, in the "DEPLOY & RUN TRANSACTIONS" pane, set the ENVIRONMENT to "Injected Web3".

On the "Guess the number" page, copy the address of your deployed contract.

In the Remix page, in the lower portion of the "DEPLOY & RUN TRANSACTIONS" pane, paste that address into the box next to the "At Address" button, outlined in red in the image below.

Click the "At Address" button.

Calling the guess Function

In the Remix page, at the bottom of the "DEPLOY & RUN TRANSACTIONS" pane, expand the "GUESSTHENUMBERCHALLENGE AT ..." container.

In the field next to the red guess button, enter 42, as outlined in green in the image above.

Click the red guess button.

If a box pops up saying "Gas estimation failed", click "Send Transaction".

A MetaMask box pops up. Notice that the amount sent is less than 1 ETH, outlined in blue in the image above.

Click Confirm.

At the lower right, a red X icon appears, indicating that the transaction failed, outlined in red in the image below.

Paying 1 ETH

As noted earlier, the guess() function requires a payment of 1 ETH.

At the top left, enter a VALUE of 1 Ether, outlined in green in the image above.

Click the red guess button.

A MetaMask box pops up. Notice that the amount sent is more than 1 ETH.

Click Confirm.

Now the function call succeeds, showing green check mark in the lower right pane of the Remix window, outlined in green in the image below.

Completing the Challenge

On the "Guess the number" page, on the left side, click the "Check Solution" button.

A MetaMask box pops up. Click Confirm. You win, and a little dancing figure appears on the lower left, as shown below.

Flag C 603.1 GIF Name (15 pts)

In your browser, on the top left, a green check mark appeared next to the "Guess the number" title, outlined in red in the image above.

Right-click that check mark and click Inspect.

The flag is the filename of this GIF image, covered by a green rectangle in the image below.

Sources

Ethereum Smart Contract Development | Capture the Ether Problem 1 & 2
Capture the Ether (Part 1 of 3): Exploring Ethereum Lottery Vulnerabilities
Capture The Ether: token sale
Capture The Ether: token whale
Solidity array overflow

Posted 5-20-22 by Sam Bowne