CryptoCurrency (is) The Flag

Registration / Rules / Challenges / ScoreBoard

The CCTF guide for beginners

Cryptocurrencies such as Bitcoin and Ethereum allow you to handle digital assets on decentralized networks. In most cases the assests are simply coins, but here is where Ethereum can provide you more: smart contracts. Imagine coding a program that you broadcast once to a decentralized network, it gets stored on the blockchain and can be called anytime in the future. Or imagine a business that does not have physical contracts, just virtual ones. All these are secure as long as somebody successfully cheats the consensus or exploits vulnerabilities in contrats. It may sound complicated for the first, but it is not. Let's see a practical example.


Most of the Ethereum hacks (breaking smart contracts, accessing accounts without or with weak authentication, phishing) do not require more than a web browser and a bit of coding skills. For the start, only a FireFox or a Chromium/Chrome web broswer will be enough to connect to the test network and to use an addon which allows interacting with (maybe) your first live smart contract.


Open your FireFox or Chromium browser and install the MetaMask extension: https://metamask.io/. Currenly, MetaMask is the most commonly used software by end users to interact with Ethereum systems. After getting the extension, it either automatically opens up or you can open it from the top right bar in your browser. The first step of using MetaMask is to generate a wallet. At this point you are asked to provide a password. Preferably, use a passphrase that is like a sentence, but does not include words from dictionaries (example: "HaxxA11co|ns"). Choose wisely. Move on and read the phishing warning carefully. Finally you need to make sure the secret backup phrase that allows restoring the wallet is secured somewhere, of course in a place only you can access and see.


All is set, now you have an Ethereum account.


MetaMask allows you to change between Ethereum networks. Please change to Ropsten and note that the game will be played there too.


Now it is time to get some free test Ethereum from: https://faucet.ropsten.be/


Let's compile an example smart contract and interact with it. Open https://remix.ethereum.org/ where you get an example contract written in Solidity language. Remix website has an inbuilt compiler and if you click on "Start to compile" it will compile the code. Now you can swith to the "Run" tab. If you have MetaMask running, then you should see "Injected web3" in the environment.

MetaMask injects the so called web3.js into each website you visit, that way the website can communicate with MetaMask (also think about that: is it a good idea to inject to all sites?).

Make sure your MetaMask account is unlocked, switched to "Ropsten" and you got a coin from the faucet. Then click on "Deploy".

MetaMask pops you up a transaction which is actually the deployment of the compiled smart contract to the Ropsten Ethereum test network. Now you may wonder what "gas fee" is? Gas limits the computational efforts of the smart contract, meaning you cannot deploy a computational heavy infinite loop for free. You can only use a smart contract if enough gas is provided. If you are ready, click on "Confirm".

Wait until the transaction changes from "Pending" state to "Confirmed". This is indicated in MetaMask. The network needs time to make sure your conract is broadcasted and mined successfully. If you click on the transaction, you have a button "View transaction on Etherscan": click on it and have a look at what happened.

By going back to https://remix.ethereum.org/ you can start playing with the "Deployed Contracts", under the "Run" tab. You can call the deployed smart contract's functions one by one. Each call you initiate takes a transaction. The executed code runs on all of the Ropsten Ethereum nodes.

Congratulations, you have compiled your first smart contract and interacted with it.


You have seen the very basics now and it is time to think about what can go wrong... Weak passwords, phishing MetaMask users, programmers making mistakes in smart contracts that you can call and so on. Remember, the Ethereum nodes may be insecure too, just like someone forgetting to configure authentication for an admin page on a webshop.


References, to learn more:

Ethereum white paper
Ethereum beige paper (a readable version of the yellow paper)
Do it yourself — reconstruct the $1,000,000 hack!
Ethereum RPC security
History of Ethereum Security Vulnerabilities, Hacks and Their Fixes (2017 Sept.)