Writeup for the Dex level of the Ethernaut: draining a token through price manipulation in the DEX swap formula.
Writeup for the Dex Two level of the Ethernaut: emptying both tokens by swapping an arbitrary attacker-controlled token.
Writeup for the Shop level of the Ethernaut: buying for less by returning different prices across two calls to a view function.
Writeup for the Denial level of the Ethernaut: blocking withdrawals by consuming all forwarded gas in a malicious receive function.
Writeup for the Alien Codex level of the Ethernaut: overwriting the owner slot through a dynamic array length underflow.
Writeup for the Magic Number level of the Ethernaut: crafting a tiny contract in raw EVM bytecode that returns the magic value 42.
Writeup for the Naught Coin level of the Ethernaut: bypassing the ERC20 timelock by moving tokens through transferFrom and an allowance.
Writeup for the Preservation level of the Ethernaut: hijacking the contract via a delegatecall storage-slot collision.
Writeup for the Recovery level of the Ethernaut: recomputing a lost contract address from the deployer nonce with RLP encoding.
Writeup for the Gatekeeper Two level of the Ethernaut: clearing the extcodesize and XOR gates from within a constructor.
Writeup for the Gatekeeper One level of the Ethernaut: passing the gas, caller and key gates with careful masking and gas tuning.
Writeup for the Privacy level of the Ethernaut: unlocking the contract by reading a private key straight from its storage layout.
