Ethernaut Level 8 Walkthrough - Vault

This level emphasize on the concept of Blockchain that everything on a Blockchain is for everyone there to see. In this level, the contract acts a vault which requires a password to get in. Let’s breakdown the contract first to understand it.

The contract starts with declaring two State Variables, a boolean “locked” and a bytes32 “password” which are public and private respectively. Remember that State Variables are stored on the Blockchain.

bool public locked;
bytes32 private password;

Next is the constructor of the contract which takes in the password as the parameter and sets the “locked” to true and saves the password in the variable “password”.

constructor(bytes32 _password) {
    locked = true;
    password = _password;
  }

A function by the name unlock() also resides there which asks for the password in the parameter and checks if it is the correct password then proceed to set the “locked” to false unlocking the Vault.

function unlock(bytes32 _password) public {
    if (password == _password) {
      locked = false;
    }
  }

Now this states that the contract requires a _password in its unlock() function to win the level. See that the _password is going inside the constructor while we initialize the contract so the password is already there we just need to extract it somehow to put it inside our unlock() function.

You see that the password variable is declared as private so it means no other contract can access it but it is declared as a State Variable which implies that it is stored on the Blockchain. So we need to extract the password right from the Blockchain.

Since Blockchain has its transparency we can check the storage to see the State Variables value. Now since the first declared variable is “locked”, its index must be at 0. The second declared variable is “password” which we need to see the value of, its index must be at 1.

We can use the following command to check the value of “password”

Now use this value in the unlock() function by the following command

Finally just click “Submit Instance” and you win!