Writeups/Ethernaut/Gatekeeper One
HardEthernaut · Ethernaut2024

Gatekeeper One

Gate Bypass via Gas Tuning and Bitmasked Key

Three gates must be passed simultaneously: gate 1 requires `tx.origin != msg.sender` (use an intermediate contract); gate 2 requires a specific gas remainder (`gasleft() % 8191 == 0`); gate 3 requires a key satisfying three bitwise constraints.

SolidityGas EstimationType Castingtx.origingasleft()

00Overview

Three gates must be passed simultaneously: gate 1 requires `tx.origin != msg.sender` (use an intermediate contract); gate 2 requires a specific gas remainder (`gasleft() % 8191 == 0`); gate 3 requires a key satisfying three bitwise constraints.

01Derive the gate key

Gate 3 constraints: uint32(key) == uint16(key), uint32(key) != uint64(key), uint32(key) == uint16(uint160(tx.origin)).

javascript
bytes8 key = bytes8(uint64(uint16(uint160(tx.origin)))) | bytes8(uint64(1) << 32);

02Brute-force gas to satisfy gate 2

javascript
for (uint i = 0; i < 8191; i++) {
    try target.enter{gas: 8191 * 3 + i}(key) {
        break;
    } catch {}
}

03Level Completed

Gatekeeper One — completion screenshot 1
Gatekeeper One — completion screenshot 2