SCH CTF Arena
Level 1 Noob Hacker
Ethernaut 01 Fallback
0 / 100 EXP 100 EXP to Junior Hacker
0%

Challenge 1 / Ethernaut

Fallback

Goal

  1. Claim ownership of the contract.
  2. Reduce the contract balance to zero.

Your task

Read Fallback.sol, then complete Exploit.s.sol.

Starting facts

Start: owner = deployer. Contract balance = 0.001 ether. Player balance = 1 ether.

:~/targets/ethernaut-fallback$
Sign in to run 
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

contract Fallback {
    mapping(address => uint256) public contributions;
    address public owner;

    constructor() {
        owner = msg.sender;
        contributions[msg.sender] = 1000 * (1 ether);
    }

    modifier onlyOwner() {
        require(msg.sender == owner, "caller is not the owner");
        _;
    }

    function contribute() public payable {
        require(msg.value < 0.001 ether);
        contributions[msg.sender] += msg.value;
        if (contributions[msg.sender] > contributions[owner]) {
            owner = msg.sender;
        }
    }

    function getContribution() public view returns (uint256) {
        return contributions[msg.sender];
    }

    function withdraw() public onlyOwner {
        payable(owner).transfer(address(this).balance);
    }

    receive() external payable {
        require(msg.value > 0 && contributions[msg.sender] > 0);
        owner = msg.sender;
    }
}
How this CTF works Execution environment and verification

Is this a real smart contract execution environment?

Yes. Each submission is compiled and run through a sandboxed Foundry verifier on the server. The verifier checks the final contract state against the challenge conditions and returns a pass/fail result.

What does the Foundry verifier check?

It compiles your exploit script in an isolated sandbox, deploys the target contract, runs your exploit, then asserts the challenge condition, for example that you became the owner or drained the balance.