Update 2024-11-26-SECCON-CTF-13-Quals-Blockchain-Writeup.md

bshyuunn · Dec 6, 2024 · 48eaa69 · 48eaa69
1 parent d1273de
commit 48eaa69
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/_posts/2024-11-26-SECCON-CTF-13-Quals-Blockchain-Writeup.md b/_posts/2024-11-26-SECCON-CTF-13-Quals-Blockchain-Writeup.md
@@ -92,7 +92,7 @@ struct Wallet {
 Wallet[] public wallets;
 ```
 
-As a result, the storage slot for a new element in the array can be calculated using the formula: `keccak(0) + array length x 3`
+As a result, the storage slot for a new element in the array can be calculated using the formula: `keccak(0) + arrayLength * 3`
 
 
 By manipulating the array length in slot 0, we can cause an integer overflow during the multiplication step. This overflow allows us to overwrite the balance field of the Wallet struct with the owner address. By strategically creating wallets and controlling the overflow, we can target specific storage slots, overwrite critical data, and eventually drain all funds.