OnlyPwner - Shapeshifter Writeup-魔法少女雪殇

题目信息

挑战名称: Shapeshifter
作者: bobface
目标: 获得 100 ETH 或更多
特殊说明: 运行在 Shanghai 硬分叉（2023）

题目背景

The gas optimizooooors have launched their latest psyop in the form of a PR stunt. They deposited 100 ETH into a contract, where the first person to solve the challenge receives the full amount. Obviously, they don't want anyone to actually win this sum, so they implemented clever protections against winning the highest possible amount.

合约分析

Stunt 合约核心逻辑

contract Stunt is IStunt {
    function attempt(address target) external override onlyContract(target) {
        bytes32 firstResult = ITarget(target).first();
        require(firstResult == hex"deadbeef", "first failed");

        bytes32 secondResult = ITarget(target).second();
        require(secondResult == hex"c0ffeebabe", "second failed");

        bytes32 thirdResult = ITarget(target).third();
        require(thirdResult == hex"1337", "third failed");

        solved[target] = true;
    }

    function claimReward(address target) external override onlyContract(target) {
        require(solved[target], "not solved");
        require(!claimed[target], "already claimed");

        claimed[target] = true;

        uint256 size;
        assembly {
            size := extcodesize(target)
        }

        uint256 reward;
        if (size <= 3) {
            // Don't worry, that is impossible.
            reward = 100 ether;
        } else if (size <= 10) {
            reward = 1e12;
        } else if (size <= 100) {
            reward = 1e10;
        }

        (bool success, ) = target.call{value: reward}("");
        require(success, "transfer failed");
    }
}