Blockchain Security Writeups.

Ethereum's `private` keyword does not prevent on-chain storage reads. By using `eth_getStorageAt` to retrieve the `encryptedFlag` stored in slot 0, and then scanning historical bot transactions to find the XOR key that produces a value matching `hashedFlag` in slot 1, the `talk()` function can be called with the correct key to set `solver = msg.sender`.

The `createPortal` function in `PortalStation` performs a `delegatecall` to a hardcoded destination address. Because contract deployment addresses are deterministic (`keccak256(RLP([deployer, nonce]))`), burning nonces 0–129 with dummy contracts causes the 130th deployment to land exactly at the `orcKingdom` destination address. The attacker-controlled contract's `connect()` function then writes `true` to `isPortalActive["orcKingdom"]` through the delegatecall, entirely within `PortalStation`'s storage.

A multi-condition unlock function relies on byte truncation and a blockhash-dependent password. Understanding how Solidity handles bytes vs uint endianness reveals how to satisfy all conditions simultaneously with one crafted value.

An ETH transfer fires before the sale item is deleted from state. A malicious receive() function re-enters the purchase function while the item still exists, triggering a second payout and draining the contract balance.

The createPortal function performs a delegatecall to a hardcoded destination address. Because CREATE deployment addresses are deterministic (keccak256(RLP([deployer, nonce]))), burning nonces 0-129 causes the 130th deployment to land exactly at the target address, letting an attacker-controlled contract write through delegatecall into the caller's storage.

The introductory level exposes a `password()` function that returns a plaintext authentication credential stored in contract state. Calling `authenticate(await contract.password())` passes authentication directly.

The contract's `receive()` fallback function assigns ownership to `msg.sender` when ETH is sent and `contributions[msg.sender] > 0`. By making a small contribution first and then sending ETH directly to the contract, ownership can be seized.

In Solidity versions prior to 0.5.0, constructors were defined as functions with the same name as the contract. A typo in the contract name (`Fallout` vs `Fal1out`) means the "constructor" is actually a public function callable by anyone.

The contract derives its "random" flip outcome from `blockhash(block.number - 1)`. Since this value is deterministic within the same block, a front-running attack contract can pre-compute the outcome and call `flip()` with the guaranteed correct guess.

The contract grants ownership when `tx.origin != msg.sender`. Calling via an intermediate contract satisfies this condition because `tx.origin` is the original EOA while `msg.sender` is the intermediate contract address.