Secureum Book
  • 🛡️Secureum Bootcamp
    • 🛡️Secureum Bootcamp
    • 🙌Participate
    • 📜History
  • 📚LEARN
    • Introduction
      • 🔷1. Ethereum Basics
        • 1.1 Ethereum: Concept, Infrastructure & Purpose
        • 1.2 Properties of the Ethereum Infrastructure
        • 1.3 Ethereum vs. Bitcoin
        • 1.4 Ethereum Core Components
        • 1.5 Gas Metering: Solving the Halting Problem
        • 1.6 web2 vs. web3: The Paradigm Shift
        • 1.7 Decentralization
        • 1.8 Cryptography, Digital Signature & Keys
        • 1.9 Ethereum State & Account Types
        • 1.10 Transactions: Properties & Components
        • 1.11 Contract Creation
        • 1.12 Transactions, Messages & Blockchain
        • 1.13 EVM (Ethereum Virtual Machine) in Depth
        • 1.14 Transaction Reverts & Data
        • 1.15 Block Explorer
        • 1.16 Mainnet & Testnets
        • 1.17 ERCs & EIPs
        • 1.18 Legal Aspects in web3: Pseudonymity & DAOs
        • 1.19 Security in web3
        • 1.20 web2 Timescales vs. web3 Timescales
        • 1.21 Test-in-Prod. SSLDC vs. Audits
        • Summary: 101 Keypoints
      • 🌀2. Solidity
        • 2.1 Solidity: Influence, Features & Layout
        • 2.2 SPDX & Pragmas
        • 2.3 Imports
        • 2.4 Comments & NatSpec
        • 2.5 Smart Contracts
        • 2.6 State Variables: Definition, Visibility & Mutability
        • 2.7 Data Location
        • 2.8 Functions
        • 2.9 Events
        • 2.10 Solidity Typing
        • 2.11 Solidity Variables
        • 2.12 Address Type
        • 2.13 Conversions
        • 2.14 Keywords & Shorthand Operators
        • 2.15 Solidity Units
        • 2.16 Block & Transaction Properties
        • 2.17 ABI Encoding & Decoding
        • 2.18 Error Handling
        • 2.19 Mathematical & Cryptographic Functions
        • 2.20 Control Structures
        • 2.21 Style & Conventions
        • 2.22 Inheritance
        • 2.23 EVM Storage
        • 2.24 EVM Memory
        • 2.25 Inline Assembly
        • 2.26 Solidity Version Changes
        • 2.27 Security Checks
        • 2.28 OpenZeppelin Libraries
        • 2.29 DAppSys Libraries
        • 2.30 Important Protocols
        • Summary: 201 Keypoints
      • 🔏3. Security Pitfalls & Best Practices
        • 3.1 Solidity Versions
        • 3.2 Access Control
        • 3.3 Modifiers
        • 3.4 Constructor
        • 3.5 Delegatecall
        • 3.6 Reentrancy
        • 3.7 Private Data
        • 3.8 PRNG & Time
        • 3.9 Math & Logic
        • 3.10 Transaction Order Dependence
        • 3.11 ecrecover
        • 3.12 Unexpected Returns
        • 3.13 Ether Accounting
        • 3.14 Transaction Checks
        • 3.15 Delete Mappings
        • 3.16 State Modification
        • 3.17 Shadowing & Pre-declaration
        • 3.18 Gas & Costs
        • 3.19 Events
        • 3.20 Unary Expressions
        • 3.21 Addresses
        • 3.22 Assertions
        • 3.23 Keywords
        • 3.24 Visibility
        • 3.25 Inheritance
        • 3.26 Reference Parameters
        • 3.27 Arbitrary Jumps
        • 3.28 Hash Collisions & Byte Level Issues
        • 3.29 Unicode RTLO
        • 3.30 Variables
        • 3.31 Pointers
        • 3.32 Out-of-range Enum
        • 3.33 Dead Code & Redundant Statements
        • 3.34 Compiler Bugs
        • 3.35 Proxy Pitfalls
        • 3.36 Token Pitfalls
        • 3.37 Special Token Pitfalls
        • 3.38 Guarded Launch Pitfalls
        • 3.39 System Pitfalls
        • 3.40 Access Control Pitfalls
        • 3.41 Testing, Unused & Redundand Code
        • 3.42 Handling Ether
        • 3.43 Application Logic Pitfalls
        • 3.44 Saltzer & Schroeder's Design Principles
        • Summary: 201 Keypoints
      • 🗜️4. Audit Techniques & Tools
        • 4.1 Audit
        • 4.2 Analysis Techniques
        • 4.3 Specification, Documentation & Testing
        • 4.4 False Positives & Negatives
        • 4.5 Security Tools
        • 4.6 Audit Process
        • Summary: 101 Keypoints
      • ☝️5. Audit Findings
        • 5.1 Criticals
        • 5.2 Highs
        • 5.3 Mediums
        • 5.4 Lows
        • 5.5 Informationals
        • Summary: 201 Keypoints
  • 🌱CARE
    • CARE
      • CARE Reports
  • 🚩CTFs
    • A-MAZE-X CTFs
      • Secureum A-MAZE-X
      • Secureum A-MAZE-X Stanford
      • Secureum A-MAZE-X Maison de la Chimie Paris
Powered by GitBook
On this page
  • Beginner level
  • Challenge 1: SecureVault
  • Challenge 2: Weirdo
  • Challenge 3: TimeLock
  • Intermediate level
  • Challenge 4: Padlock
  • Challenge 5: BecomeMaster
  • Advanced
  • Challenge 6: Vault
  1. CTFs
  2. A-MAZE-X CTFs

Secureum A-MAZE-X

PreviousA-MAZE-X CTFsNextSecureum A-MAZE-X Stanford

Last updated 1 year ago

Welcome to Secureum's a-MAZE-X challenge!

Within this repository you will find:

  • the project's dependencies

  • the smart contract codes

  • tests scripts (written in JS)

The smart contracts to be hacked are located within the contracts directy.

Each challenge consists of a single solidity source file.

You can run each challenge using the hardhat tests;

## Challenge 1
npx hardhat run test/N1-SecureVault-easy.js

## Challenge 2
npx hardhat run test/N2-Weirdo-easy.js

## Challenge 3
npx hardhat run test/N3-TimeLock-easy.js

## Challenge 4
npx hardhat run test/N4-Padlock-medium.js

## Challenge 5
npx hardhat run test/N5-BecomeMaster-medium.js

Challenges are grouped in 3 different levels, and each challange awards different quantities of points to your score.

Beginner level

I see, you are an aspiring group of security experts... Let's check if you know your A, B, Cs with these challenges ;)

Challenge 1: SecureVault

We have deployed a secure vault protected with a secret private password seed and a random generated one.
Can you guess the secret private password and drain all the locked funds?

This challenge adds 1 ether to your score. 

Challenge 2: Weirdo

We have deployed a vault that will lock the founds forever, since it's protected with a tautology.
If only there was a way to break it... 

Anyways, it's a vault where funds are locked forever! HAHAHAH

This challenge adds 1.1 ether to your score.

Challenge 3: TimeLock

This is yet another vault, but this time the funds are locked for a week.
But you really need those funds now... Such a shame!!!

This challenge adds 1.2 ether to your score.

Intermediate level

If you didn't sweat with the previous 3 contracts, it's time to turn the heat up a bit!

These contracts require more patience and attention to detail. Good luck security experts!

Challenge 4: Padlock

This is a padlock to be opened... If you can.
Be careful, becuse if you're too hard with it, the padlock breaks!

The password to open the first padlock is `activatexwormholemiami`,
you will have to figure out how to open the remaining ones.

This challenge adds 2 ether to your score.

! An additional hint is: If the compiler does not allow implicit conversion but you are confident a conversion will work, an explicit type conversion is sometimes possible. This may result in unexpected behaviour and allows you to bypass some security features of the compiler e.g. int to uint. If an integer is explicitly converted to a smaller type, higher-order bits are cut off. If an integer is explicitly converted to a larger type, it is padded on the left (i.e., at the higher order end). Fixed-size bytes types while explicitly converting to a smaller type and will cut off the bytes to the right. Fixed-size bytes types while explicitly converting to a larger type and will pad bytes to the right.

Challenge 5: BecomeMaster

This is a vault, where only the master can take out all the funds!
If there was only a way to become the master yourself to escape with the funds...

This challenge adds 2 ether to your score.

Advanced

If you've gotten this far, you're are on the right track for becoming the next security superstars!

This last challenge will be absolutely different to every challenge you've faced until now.

Good luck!

Challenge 6: Vault

Yet another Vault...
Some criminal you're following has locked their stolen fortune in the form of a bank's governance token.

It is your mission to infiltrate the bank's governance, take over it and steal the criminal's money.
That'll show them! Right?

This challenge adds 5 ether to your score.

! In case you got stuck, check out and .

! In case you got stuck, check out .

! In case you got stuck, check out .

! In case you got stuck, check out .

! In case you got stuck, check out .

🚩
this link
this link
this link
this link
this link
this link
amazeXlogo