OnlyPwner BRIDGE TAKEOVER writeup

评价为，一个真正的pwn题。

从头开始，先看部署合约

contract Deploy is Script {
    function run() external {
        vm.startBroadcast();

        address user = vm.envAddress("USER");
        Bridge bridge = new Bridge();

        payable(user).transfer(1 ether);
        bridge.registerValidator{value: 100 ether}(address(0), "Some Tag");

        console.log("address:Bridge", address(bridge));
    }
}

没什么好说的，单纯部署合约然后给user1 ether，调用registerValidator并转入100 ether。

那么看看solved条件。

contract IsSolved is Script {
    function run() external view {
        Bridge bridge = Bridge(vm.envAddress("Bridge"));

        if (bridge.stateRoot() == bytes32(uint256(0xdeadbeef))) {
            console.log("is-solved:true");
        } else {
            console.log("is-solved:false");
        }
    }
}

让bridge.stateRoot() == bytes32(uint256(0xdeadbeef)即可。

那么接下来就开始分析合约把。