// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

contract Preservation {

  // public library contracts 
  address public timeZone1Library;
  address public timeZone2Library;
  address public owner; 
  uint storedTime;
  // Sets the function signature for delegatecall
  bytes4 constant setTimeSignature = bytes4(keccak256("setTime(uint256)"));

  constructor(address _timeZone1LibraryAddress, address _timeZone2LibraryAddress) {
    timeZone1Library = _timeZone1LibraryAddress; 
    timeZone2Library = _timeZone2LibraryAddress; 
    owner = msg.sender;
  // set the time for timezone 1
  function setFirstTime(uint _timeStamp) public {
    timeZone1Library.delegatecall(abi.encodePacked(setTimeSignature, _timeStamp));

  // set the time for timezone 2
  function setSecondTime(uint _timeStamp) public {
    timeZone2Library.delegatecall(abi.encodePacked(setTimeSignature, _timeStamp));

// Simple library contract to set the time
contract LibraryContract {

  // stores a timestamp 
  uint storedTime;  

  function setTime(uint _time) public {
    storedTime = _time;
contract Exploit{
  uint num1;
  uint num2;
  uint num3;

  function setTime(uint256 _time) public {
    num3 = _time;

The above is the ethernaut challenge and here the LibraryContract is deployed by the creator and the preservation contract will call the Library contract and changes the timeZone1Library.So i have passed the uint variable of my exploit contract address i.e(uint256(uint160(address(ExploitAddress)))).Then i success fully changes the storage slot 0 in the preservation contract .But when i tried to changes the owner of the preservation contract using exploit contract by using the same above process of changing the address to the uint.I failed to replace the storage slot of owner variabele.let me know what mistake i did with my exploit contract

1 Answer 1


Maybe when creating Preservation you passed the Exploit address first and then the LibraryContract? And called setSecondTime. This is the case when Exploit.setTime() won't work, because setSecondTime will change the Exploit address before it is used.

Just do it again) If when you created the Preservation contract you passed the LibraryContract address to the constructor first and then Exploit then the setFirstTime function works only once (or several times if you pass only the LibraryContract address into it) and then changes the address to call the LibraryContract. The setSecondTime function will work all the time

  • It is better to create libraries with the code "library" instead of "contract" if you are writing protected code) Sep 19, 2023 at 9:02
  • but why the setFirstTime function works only once?For me when i first tried to call the setFirsttime to change the varible 'timeZone1Library' its work and the variable was changed to my exploit contract address again I tried to call the setFirstTime it doesn't worked.
    – kumar
    Sep 19, 2023 at 9:57
  • Because the first time the timeZone1Library variable contained the address of the LibraryContract. And after the first call, it overwrites the value in the timeZone1Library variable. This is the address that is used in the setFirstTime() function. And after overwriting, an unknown contract will be called here: timeZone1Library.delegatecall(...) // most likely, a missing contract Sep 19, 2023 at 11:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.