{"id":13341229,"url":"https://github.com/Bobface/onlypwner-challenges","last_synced_at":"2025-03-11T20:33:02.730Z","repository":{"id":194980884,"uuid":"691979458","full_name":"Bobface/onlypwner-challenges","owner":"Bobface","description":"Challenges for the ONLYPWNER CTF Platform","archived":false,"fork":false,"pushed_at":"2024-07-30T17:09:05.000Z","size":121,"stargazers_count":37,"open_issues_count":0,"forks_count":11,"subscribers_count":1,"default_branch":"dev","last_synced_at":"2024-07-30T21:28:16.129Z","etag":null,"topics":["capture-the-flag","challenges","ctf","ethereum","evm","wargame","wargames"],"latest_commit_sha":null,"homepage":"https://onlypwner.xyz","language":"Solidity","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Bobface.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-09-15T09:46:35.000Z","updated_at":"2024-07-30T17:08:51.000Z","dependencies_parsed_at":null,"dependency_job_id":"1aaf0376-6707-44be-86f9-c5eb42558ab1","html_url":"https://github.com/Bobface/onlypwner-challenges","commit_stats":null,"previous_names":["bobface/onlypwner-challenges"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Bobface%2Fonlypwner-challenges","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Bobface%2Fonlypwner-challenges/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Bobface%2Fonlypwner-challenges/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Bobface%2Fonlypwner-challenges/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Bobface","download_url":"https://codeload.github.com/Bobface/onlypwner-challenges/tar.gz/refs/heads/dev","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":221249538,"owners_count":16784960,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["capture-the-flag","challenges","ctf","ethereum","evm","wargame","wargames"],"created_at":"2024-07-29T19:25:14.174Z","updated_at":"2024-10-23T23:30:50.148Z","avatar_url":"https://github.com/Bobface.png","language":"Solidity","funding_links":[],"categories":[],"sub_categories":[],"readme":"# ONLYPWNER Challenges\n\n![Banner](./banner.jpg)\n\nChallenges for the [ONLYPWNER CTF Platform](https://onlypwner.xyz).\n\nThis repository welcomes submissions via PRs. If you have an idea for an interesting challenge and want it featured on the site, please carefully read the sections below to get started.\n\nIf something remains unclear, hop on the [ONLYPWNER Discord server](https://discord.gg/tukqhC3EUH) to reach out for help!\n\n# Creating your own challenge\n### What makes a good challenge?\nThe platform values quality over quantity. Each new challenge should introduce a new concept, technique, or unique structure, and shouldn't just be a simple repetition of previous challenges. There can certainly be multiple challenges that involve the same type of bug, for example a re-entrancy vulnerability. However, each one should present it in a different context or require a distinct approach to solve it.\n\nA degree of realism is also wished for. Each challenge is accompanied by a description that sets the scene, and the source code should be built in a way that resembles a real deployment. For example, a challenge where the user has to drain a yield-farming `Vault` of its funds is more engaging than a `HackMe` contract where the `challengeSolvedSuccessfully` flag has to be set to `true`.\n\nIt's a good idea to scroll through (or also solve!) a couple of challenges on the site first to get a feeling of the existing challenges.\n\n### Choosing the difficulty\nYou can make your challenge as easy or hard as you please. The difficulty will be on a scale of 1 to 5. There are two main factors that influence the final difficulty:\n1. How hard it is to identify the issue\n2. How hard it is to exploit the issue\n\n*Examples*:\n1. A missing `onlyOwner` modifier on a method can be easily identified by casually scrolling through the source code. A bug involving Solidity's behind-the-scenes memory management is harder to find.\n2. Calling a method with a parameter that overflows an integer and thus solves the challenge is quite easy to do. Having to deploy multiple custom contracts with sophisticated logic is hard.\n\n### The execution environment\nChallenge instances are executed on a local EVM devnet starting with a clean state on block 0. While you can use challenges that involve external protocols (e.g. Uniswap), keep in mind that you will have to deploy them yourself. \n\n## What not to do\n- Leaking information about the challenge solution\n- Challenges that involve unfixed bugs in real deployments\n- Challenges that negatively describe real persons or entities\n- Huge challenges with lots of source files and lines of code\n\n## Submitting your challenge\nOnce you are ready to submit, create a PR to the `dev` branch of this repository. \n\n**Please also send an email** to *bobface at onlypwner dot xyz* with\n- your challenge name in the subject\n- a brief description of the challenge bug and solution in the body\n- and a solution PoC in the form of a forge script in the attachment\n\nThis let's me verify that the challenge is working as intended.\n\n**DO NOT** leak information about the challenge solution anywhere, including in the PR description, challenge files, commit message, etc. Since this is a public repository, this means your challenge would need to be rejected.\n\n\n## Challenge files\nEach challenge consists of some metadata files, source code, and administration code. It's recommended to briefly look through some challenges in this repo first to get a feeling for the structure. The containing folder should be named `[your ONLYPWNER username]-[challenge name]`\n\n#### `manifest.json`\nContains the following JSON fields:\n- `name`: The name of the challenge\n- `author`: The author of the challenge (your ONLYPWNER username)\n- `xHandle`: Your X/Twitter handle without the `@`\n- `difficulty`: 1-5\n- `hardfork`: The hardfork the challenge should run on. Use `latest` for the default.\n- `uuid`: A unique UUIDv4. You can use an online tool [like this one](https://www.uuidgenerator.net/version4) to generate it.\n- `version`: Should be `1` for new submissions.\n\n#### `DESCRIPTION.md`\nA markdown file that sets the scene. The last lines should be the `### WINNING CONDITION` section that briefly describes what needs to be achieved to solve the challenge.\n\n#### `dependencies.txt` (optional)\nIf your challenge requires external dependencies (e.g. OpenZeppelin contracts), this file lists them line-by-line together with their commit hash. For example: \n```\nhttps://github.com/Uniswap/v2-periphery@0335e8f7e1bd1e8d8329fd300aea2ef2f36dd19f\nhttps://github.com/Uniswap/v2-core@ee547b17853e71ed4e0101ccfd52e70d5acded58\nhttps://github.com/OpenZeppelin/openzeppelin-contracts@812404cee89cd91d46f6234d03451b07eebf2e35\nhttps://github.com/Uniswap/solidity-lib@c01640b0f0f1d8a85cba8de378cc48469fcfd9a6\n```\n\nThese will be automatically installed when the challenge is compiled. \n\nNote: Please keep external dependencies to a minimum. Generally, only well-known and established libraries are allowed to be included.\n\n#### `remappings.txt` (optional)\nA forge remappings file if needed. For example:\n```\n@uniswap/v2-core=lib/v2-core\n@uniswap/lib=lib/solidity-lib\n```\n\n#### `script/*`\nThere are two scripts that set up and check a challenge. Each script is a forge script, and can make use of special environment variables accessible via `vm.envAddress(\"...\")`:\n- `USER`: The address the user will use to send transactions\n- `SCRIPTER`: The address the scripts use to send transactions\n\n##### `script/Deploy.sol`\nThis script is executed to deploy a new instance of your challenge. Its structure should be:\n```\npragma solidity ...;\n\nimport {SomeContract} from \"../src/SomeContract.sol\";\nimport {Script} from \"forge-std/Script.sol\";\nimport {console} from \"forge-std/console.sol\";\n\ncontract Deploy is Script {\n    function run() external {\n        vm.startBroadcast();\n\n        SomeContract someContract = new SomeContract();\n\n        console.log(\"address:SomeContract\", address(someContract));\n    }\n}\n```\n\nYou can execute calls, send funds, and do whatever is required to set up the environment in this script. Most importantly, it must log the necessary  addresses at the end. They will be displayed to the user on the UI and also be fed back into the `IsSolved` script.\n\n##### `script/IsSolved.sol`\nThis script checks whether the challenge is solved. It should have the following structure:\n\n```\npragma solidity ...;\n\nimport {SomeContract} from \"../src/SomeContract.sol\";\nimport {console} from \"forge-std/console.sol\";\nimport {Script} from \"forge-std/Script.sol\";\n\ncontract IsSolved is Script {\n    function run() external view {\n        // Your logged addresses from Deploy.sol are available\n        address someContract = vm.envAddress(\"SomeContract\");\n\n        if (someContract.balance == 0) {\n            // Winning condition\n            console.log(\"is-solved:true\");\n        } else {\n            console.log(\"is-solved:false\");\n        }\n    }\n}\n```\n\nYou can also execute state-altering operations in this script (like sending funds). Just keep in mind that this script can be executed multiple times in the same environment, when the user clicks \"CHECK\" repeatedly. \n\n#### `src/*.sol`\nPlace your challenge source files here. \n\n\n#### `src/interfaces/*.sol`\nYou **must** include `interface`s for your source contracts. This is a convenience for the users interacting with the challenges.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FBobface%2Fonlypwner-challenges","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FBobface%2Fonlypwner-challenges","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FBobface%2Fonlypwner-challenges/lists"}