I am a cyber security analyst who is new to ethereum and working on a project to study crypto security. It's a series of 22 vulnerable smart contracts that you're supposed to exploit. For anyone who is interested, here's the challenge:


I'm trying to configure a truffle project for the challenge using this guide: https://www.notonlyowner.com/ethereum/solving-zeppelin-ethernaut-ctf-fallback/ and after I run the installation command:

npm i truffle@4 ganache-cli@6 openzeppelin-solidity@2.0.0

I'll try to deploy the contract and I get a bunch of errors. I started trying to fix them and knocked out a few, but I feel like there's gotta be a better solution. If an experienced blockchain dev would help me get this deployed I'd really appreciate it, been bashing my head against my desk at work all day. I've posted the source code and my errors below:

pragma solidity ^0.4.18;

import 'zeppelin-solidity/contracts/ownership/Ownable.sol';

contract Fallback is Ownable {

  mapping(address => uint) public contributions;

  function Fallback() public {
    contributions[msg.sender] = 1000 * (1 ether);

  function contribute() public payable {
    require(msg.value < 0.001 ether);
    contributions[msg.sender] += msg.value;
    if(contributions[msg.sender] > contributions[owner]) {
      owner = msg.sender;

  function getContribution() public view returns (uint) {
    return contributions[msg.sender];

  function withdraw() public onlyOwner {

  function() payable public {
    require(msg.value > 0 && contributions[msg.sender] > 0);
    owner = msg.sender;

The errors:

Compiling ./contracts/Fallback.sol...
Compiling ./contracts/Migrations.sol...
Compiling openzeppelin-solidity/contracts/ownership/Ownable.sol...

/home/awile/smart_contracts/ethernaut/contracts/Fallback.sol:16:48: TypeError: Type function () view returns (address) is not implicitly convertible to expected type address.
        if(contributions[msg.sender] > contributions[owner]) {
,/home/awile/smart_contracts/ethernaut/contracts/Fallback.sol:17:4: TypeError: Expression has to be an lvalue.
            owner = msg.sender;
,/home/awile/smart_contracts/ethernaut/contracts/Fallback.sol:17:12: TypeError: Type address is not implicitly convertible to expected type function () view returns (address).
            owner = msg.sender;
,/home/awile/smart_contracts/ethernaut/contracts/Fallback.sol:31:3: TypeError: Expression has to be an lvalue.
        owner = msg.sender;
,/home/awile/smart_contracts/ethernaut/contracts/Fallback.sol:31:11: TypeError: Type address is not implicitly convertible to expected type function () view returns (address).
        owner = msg.sender;
Compilation failed. See above.

Edit: fixed by downgrading openzeppelin-solidity to 1.11.0

npm uninstall openzeppelin-solidity
npm i openzeppelin-solidity@1.11.0

Great to hear that you are using Ethernaut to learn more about smart contract security.

I would suggest that for the Fallback level you just use the console. I can then help with getting an environment setup.

Some hints on the Fallback level.

There are a number of community solutions to Ethernaut levels and you could even add your own as you work through them. https://forum.zeppelin.solutions/t/ethernaut-community-solutions/561

If you have any feedback on Ethernaut please post in the community forum: https://forum.zeppelin.solutions

The community are currently working on updating Ethernaut, you would be welcome to join.

  • Yes will do, thank you. I'm not entirely new to the smart contract security (I did challenges 1-8 in the browser/remix) I'm just re-doing them now for the purpose of seeing what's happening in the blockchain as tx are executed. But thanks for the advice, I figured it out yesterday on my own. :) May 21 '19 at 17:35
  • Glad you were able to resolve yourself. Until the level is updated by the community, to get the code to compile you can install the deprecated Zeppelin-Solidity npm i zeppelin-solidity The OpenZeppelin repo is at github.com/OpenZeppelin/openzeppelin-solidity
    – abcoathup
    May 22 '19 at 6:52
  • Thanks, npm i openzeppelin-solidity@1.11.0 also works fine for anyone having the same problem. May 22 '19 at 16:46

Maybe it will be easier for you to start with http://remix.ethereum.org and move to ganache after you gather some experience (or just stay in remix).

The main problem here is that you will need openzeppelin-solidity@1.5.0 not openzeppelin-solidity@2.0.0

Then in Remix make sure to select v0.4.18 as your compiler

  • I've done a few in Remix already but I hate the interface. I understand it all, I'm just having compatibility issues. Trying now, will let you know if it fixes. May 20 '19 at 18:02

In OpenZeppelin v1.x, variable owner is public, hence a getter function owner() is implicitly added by the compiler.

In OpenZeppelin v2.x, they realized that since contract Ownable is designated to be inherited from, any contract which inherits from it may choose to change the owner variable.

This capability is undesired for this variable, so in order to protect it, they changed it from address public owner to address private _owner, and then added a getter function explicitly.

The bottom line is that you need to change contributions[owner] to contributions[owner()], but note that you would need to fix this whether you chose to work with OZ v1.x or OZ v2.x.

Subsequently, since you chose to work with OZ v2.x, in order to set this variable to a different value, you will need to use function renounceOwnership and function transferOwnership.

On a personal level, if contract Ownable is all you need from OZ, then I strongly recommend to work with OZ v1.12.0 and use contract Claimable (which inherits from contract Ownable).

  • Nothing needed to be 'fixed'. I don't think you understood the question. ethernaut.zeppelin.solutions is a wargame, the point is to exploit the contracts in their current state. May 21 '19 at 17:38
  • @leaustinwile: Quoting you: If an experienced blockchain dev would help me get this deployed I'd really appreciate it, been bashing my head against my desk at work all day.... So, in order to deploy a contract, you'd first needs to compile it and generate the bytecode. In order to compile it, you'd first need to fix all the compilation errors. I pointed out how to fix them, how exactly is that not part of your question????? May 21 '19 at 17:54
  • 1
    The problem wasn't code related, it was package related. I had the wrong openzeppelin package installed locally. Fixing that solved all compilation issues. Sure your solution may work, but then I'm not working with the challenge in its original state. I was just trying to get the contract onto the blockchain on my VM up and running without making modifications. May 21 '19 at 18:02
  • @leaustinwile: I gave you two options - fix the code, or install OZ v1.12.0 (which I actually recommended). It sounds pretty much like the answer which you have just described. May 21 '19 at 18:05
  • Well, you actually told me to install openzeppelin and change the code. So. Yeah, what do you want? Validation? Good answer. Is it correct, sure, is it TLDR of info I don't need, also sure. It was the last thing you said, I didn't read it. May 21 '19 at 18:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.