Introduction#

Jail challenges are always a thrill. You’re thrown into a restricted environment with a single mission: escape and claim the flag. While bash, Python, and even NodeJS jails are familiar territory, running into one in Solidity is a rare treat.

In this challenge, we interacted with a remote server that executed Solidity function code we submitted. The goal? Extract a flag from another contract on the same blockchain. But there was a twist: a blacklist carefully crafted to block obvious approaches.

Navigating this puzzle felt like exploring the EVM itself. Dead ends and misleading paths were everywhere. Yet the final solution emerged smoothly, clever in its simplicity, proving that even the trickiest Solidity jail can be cracked with the right insight.

Analysis of the challange#

First off, let’s scope out the setup. We were provided with two key files:

• Jail.sol: The target contract, named in the solidity as BytecodeRunner, which features a public variable called flag and a run() function.

1
// SPDX-License-Identifier: MIT
2
pragma solidity ^0.8.20;
3

4
contract BytecodeRunner {
5

6
    string public flag = "wwf{REDACTED}";
7

8
    function run(bytes memory _bytecode, bytes32 _salt) public
9
    returns (bool success, bytes memory result)
10
    {
11
        address newContract;
12
        assembly {
13
            newContract := create2(
14
                0,
15
                add(_bytecode, 0x20),
16
                mload(_bytecode),
17
                _salt
18
            )
19
            if iszero(newContract) {
20
                revert(0, 0)
21
            }
22
        }
23

24
        bytes memory callData = abi.encodeWithSelector(
25
            bytes4(keccak256("main()"))
26
        );
27

28
        (success, result) = newContract.call(callData);
29
        require(success, "Execution of main() failed.");
30
    }
31
}

As you can see, the run() function takes our bytecode, deploys it using create2, and then calls our main() function.

• jailTalk.py: The server-side helper. It wraps whatever we submit inside a Solution contract, compiles it, and sends the resulting bytecode to the run function of BytecodeRunner.

1
#!/usr/local/bin/python
2
import signal
3
from solcx import compile_standard
4
import os
5
from web3 import Web3
6
import string
7
import requests
8
from urllib.parse import urlparse
9

10
contr_add = os.environ.get("CONTRACT_ADDDR")
11
rpc_url = os.environ.get("RPC_URL")
12

13
try:
14
    parsed = urlparse(rpc_url)
15
    resp = requests.get(f"{parsed.scheme}://{parsed.netloc}")
16
    if resp.text != "ok":
17
        print("Contact admins challenge not working...")
18
        exit()
19
except Exception as e:
20
    print("Contact admins challenge not working...")
21
    exit()
22

23

24
print("Enter the body of main() (end with three blank lines):")
25
lines = []
26
empty_count = 0
27
while True:
28
    try:
29
        line = input()
30
    except EOFError:
31
        break
32
    if line.strip() == "":
33
        empty_count += 1
34
    else:
35
        empty_count = 0
36
    if empty_count >= 3:
37
        lines = lines[:-2]
38
        break
39
    lines.append(line)
40

41
body = "\n".join(f"        {l}" for l in lines)
42

43
if not all(ch in string.printable for ch in body):
44
    raise ValueError("Non-printable characters detected in contract.")
45

46
blacklist = [
47
    "flag",
48
    "transfer",
49
    "address",
50
    "this",
51
    "block",
52
    "tx",
53
    "origin",
54
    "gas",
55
    "fallback",
56
    "receive",
57
    "selfdestruct",
58
    "suicide"
59
]
60
if any(banned in body for banned in blacklist):
61
    raise ValueError(f"Blacklisted string found in contract.")
62

63

64
source = f"""// SPDX-License-Identifier: MIT
65
pragma solidity ^0.8.20;
66

67
contract Solution {{
68
    function main() external returns (string memory) {{
69
{body}
70
    }}
71
}}
72
"""
73

74
print("Final contract with inserted main() body:")
75
print(source)
76

77
compiled = compile_standard(
78
    {
79
        "language": "Solidity",
80
        "sources": {"Solution.sol": {"content": source}},
81
        "settings": {
82
            "outputSelection": {
83
                "*": {
84
                    "*": ["evm.bytecode.object"]
85
                }
86
            }
87
        },
88
    },
89
    solc_version="0.8.20",
90
)
91

92

93
bytecode_hex = "0x" + compiled["contracts"]["Solution.sol"]["Solution"]["evm"]["bytecode"]["object"]
94
salt_hex = "0x" + os.urandom(32).hex()
95

96
web3 = Web3(Web3.HTTPProvider(rpc_url))
97

98
contr_abi = [{"inputs":[],"name":"flag","outputs":[{"internalType":"string","name":"","type":"string"}],"stateMutability":"view","type":"function"},{"inputs":[{"internalType":"bytes","name":"_bytecode","type":"bytes"},{"internalType":"bytes32","name":"_salt","type":"bytes32"}],"name":"run","outputs":[{"internalType":"bool","name":"success","type":"bool"},{"internalType":"bytes","name":"result","type":"bytes"}],"stateMutability":"nonpayable","type":"function"}]
99
contr = web3.eth.contract(address=contr_add, abi=contr_abi)
100

101
bytecode_bytes = Web3.to_bytes(hexstr=bytecode_hex)
102
salt_bytes = Web3.to_bytes(hexstr=salt_hex)
103
print(contr.functions.run(bytecode_bytes, salt_bytes).call())

Here, the most crucial part is obv the blacklist.

This blacklist effectively blocks the most straightforward exploits:

• flag: Directly calling target.flag() is prohibited.
• address: We cannot declare an address variable to hold the target contract’s location.
• gas: Access to the gas() opcode is restricted, which is often needed for low-level calls.
• this: Retrieving our own contract’s address is also disallowed.

The goal is clear: invoke the flag() function on the BytecodeRunner contract.
Since main() is executed by BytecodeRunner, the contract’s address is simply msg.sender.
The challenge comes down to circumventing these blacklist limitations basically.

My Solve#

Looking at other write-ups for this challenge, it’s clear that there were a variety of approaches to solving it. Some solutions focused heavily on the Python side, manipulating the server-side logic (like sub-stringing the “flag” keyword), while others leaned more on Solidity, crafting intricate contracts to bypass restrictions (like the definition of an interface with the same function name and type signature, then cast the contract’s address to that interface). In my case, I believe I tackled the challenge using the simplest and most straightforward method possible. In fact:

I executed the function via a low-level call, specifically using the .call() method on an address and supplying the calldata manually. But how can you calculate a calldata?

There are multiple techniques to construct the calldata in Solidity for a function invocation. Common methods include:

• abi.encodeWithSignature("functionName(types...)")
• abi.encodeCall(ContractName.functionName, (args...))
• abi.encodeWithSelector(bytes4Selector, (args...))

The first two methods rely on providing the function name as a string, which is explicitly blacklisted, so we can’t use them. Therefore, using the last one: abi.encodeWithSelector, it allows us to bypass this restriction using a function selector.

A function selector is derived as the first 4 bytes of the Keccak-256 hash of its canonical signature -> $\text{bytes4}(\text{keccak256}("functionName(inputTypes)"))$. In our case flag() has no input types, so it will be empty.

The selector for flag() is 0x890eba68. I used Foundry’s cast sig command to compute this easily.

We also need to bypass the restriction on using the address keyword. Because the main() function is executed by the target contract itself, its address is inherently available via msg.sender. This removes the necessity of defining a separate address variable. By combining the appropriate function selector with msg.sender as the destination, a conventional low-level .call() invocation suffices to execute the target function, thereby resolving the challenge.

The Payload:

1
(bool ok, bytes memory res) = msg.sender.staticcall(
2
    abi.encodeWithSelector(0x890eba68)
3
);
4
require(ok, "failed");
5
return string(res);

flag: wwf{y0u_4r3_7h3_7ru3_m4573r_0f_s0l1d17y}