Skip to content

Guess the random number

pragma solidity ^0.4.21;

contract GuessTheRandomNumberChallenge {
  uint8 answer;

  function GuessTheRandomNumberChallenge() public payable {
    require(msg.value == 1 ether);
    answer = uint8(keccak256(block.blockhash(block.number - 1), now));
  }

  function isComplete() public view returns (bool) {
    return address(this).balance == 0;
  }

  function guess(uint8 n) public payable {
    require(msg.value == 1 ether);

    if (n == answer) {
      msg.sender.transfer(2 ether);
    }
  }
}

Goal

Guess the number to win and get all the ETH from the smart contract

Exploit

The way we can win this CTF is to look into the transaction that has deployed the GuessTheRandomNumberChallenge contract. For this we can use Etherscan.

In Etherscan we can go to the "State Changes" part of the transaction and search for the state change that changes the contract ETH balance from 0 to 1.

We check this change because the contract gets 1 Ether inside the constructor and here is also where the answer variable gets assigned.

Here we can find the value of the answer variable.

etherscan.JPG