Writeups/Ethernaut/Privacy
MediumEthernaut · Ethernaut2024

Privacy

Private Array Data Readable via Storage Slot Enumeration

The unlock key is `bytes16(data[2])` — the upper 16 bytes of the value stored in slot 5 of the contract. Reading the slot directly via `eth_getStorageAt` and truncating to `bytes16` yields the correct key.

SolidityStorage Layouteth_getStorageAtType Truncation

00Overview

The unlock key is `bytes16(data[2])` — the upper 16 bytes of the value stored in slot 5 of the contract. Reading the slot directly via `eth_getStorageAt` and truncating to `bytes16` yields the correct key.

01Map the storage layout

Slot 0: locked. Slot 1: ID. Slot 2: flattening/denomination/awkwardness packed. Slots 3-5: data[0], data[1], data[2].

02Read data[2] from slot 5

javascript
const data2 = await web3.eth.getStorageAt(instance, 5)
const key   = data2.slice(0, 34)  // bytes32 -> bytes16 = first 32 hex chars + 0x
await contract.unlock(key)

03Level Completed

Privacy — completion screenshot 1