Skip to content

unhackedctf/reaper

Folders and files

NameName
Last commit message
Last commit date

Latest commit

612f738 · Sep 10, 2022

History

12 Commits
Aug 22, 2022
Aug 22, 2022
Aug 22, 2022
Sep 9, 2022
Sep 9, 2022
Aug 22, 2022
Sep 9, 2022
Aug 22, 2022
Sep 10, 2022
Aug 22, 2022
Aug 22, 2022

Repository files navigation

welcome to unhacked

unhacked is a weekly ctf, giving whitehats the chance to go back in time before real exploits and recover funds before the bad guys get them.

you are a whitehat, right anon?

meet reaper

reaper farm is a yield aggregator on fantom. their V2 vaults were hacked on 8/2.

there were a number of implementations of the vaults with damages totalling $1.7mm, but the exploit was the same on all of them, so let's just focus on one — a DAI vault hacked for over $400k.

review the code in this repo, find the exploit, and recover > $400k.

how to play

  1. fork this repo and clone it locally.

  2. update the .env file with an environment variable for FANTOM_RPC (already preset to the public RPC endpoint, which should work fine, in which case you can skip this).

  3. review the code in the src/ folder, which contains all the code at the time of the hack. you can explore the state of the contract before the hack using block 44000000. ex: cast call --rpc-url ${FANTOM_RPC} --block 44000000 0x77dc33dC0278d21398cb9b16CbFf99c1B712a87A "totalAssets()" | cast 2d

  4. when you find an exploit, code it up in ReaperHack.t.sol. the test will pass if you succeed.

  5. post on twitter for bragging rights and tag @unhackedctf. no cheating.

solution

this contest is no longer live. you can read a write up of the solution here or find the solution code in test/ReaperHackSolution.t.sol.

subscribe

for new weekly challenges and solutions, subscribe to the unhacked newsletter.

Releases

No releases published

Packages

No packages published