0

I'm trying to find the contract creation param on this one: https://rinkeby.etherscan.io/address/0xdbc4949a84cd92c482af74d8813c13588e466841#code

But I couldn't find it on etherscan, where can I find it?

e.g In Ethernaut Level 8, there's a password passed-in, https://ethernaut.openzeppelin.com/level/0xf94b476063B6379A3c8b6C836efB8B3e10eDe188. If I'm able to view the parameter passed to the constructor, I will find the password.

2
  • What do you mean contract creation pattern?
    – Emrah
    Jul 19, 2022 at 0:12
  • @Emrah Updated question
    – daisy
    Jul 19, 2022 at 1:03

1 Answer 1

1

Solidity state variables are stored at storage slots, so you can read even the private variable if you know its slot. In your context, contract is verified, so it's easy to know the password at second slot. After that, you can use any library such as: web3js, ethersjs to read the blockchain and decode the password. Here is my code to read the password of the contract you provided:

const ethers = require("ethers");
const AlchemyApiKey = "Your Alchemy's API key"
const provider = new ethers.providers.AlchemyProvider("rinkeby", 
AlchemyApiKey)

//Contract address of you to read
const contractAddress = "0xdbC4949a84cd92c482AF74D8813c13588E466841"

const hexToAscii = (_hex) => {
    const hex = _hex.toString();
    let str = ''
    for (let i = 0; i < hex.length; i += 2) {
        str += String.fromCharCode(parseInt(hex.substr(i, 2), 16));
    }
    return str;
}

async function main() {
    //The storage slot you want to read
    const storageSlot = 1;
    const storage = await provider.getStorageAt(contractAddress, storageSlot)
    res = hexToAscii(storage)
    console.log(res);
}

main().catch((error) => {
    console.error(error);
    process.exitCode = 1;
});

After run above code, I got the password is A very strong secret password :). You can try it yourself and replace API key with your Alchemy api key. I refer to this post at Medium, you can read more about it. Also read the docs of Solidity about storage slot here.

1
  • This is better than reading the contract parameter, nicely done.
    – daisy
    Jul 19, 2022 at 2:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.