Update 2024-11-26-SECCON-CTF-13-Quals-Writeup.md

bshyuunn · Nov 28, 2024 · 9f4ab8f · 9f4ab8f
1 parent 5431eb0
commit 9f4ab8f
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/_posts/2024-11-26-SECCON-CTF-13-Quals-Writeup.md b/_posts/2024-11-26-SECCON-CTF-13-Quals-Writeup.md
@@ -92,7 +92,8 @@ struct Wallet {
 Wallet[] public wallets;
 ```
 
-As a result, the storage slot for a new element in the array can be calculated using the formula:
+As a result, the storage slot for a new element in the array can be calculated using the formula: `keccak(0) + array length x 3`
+
 
 By manipulating the array length in slot 0, we can cause an integer overflow during the multiplication step. This overflow allows us to overwrite the balance field of the Wallet struct with the owner address. By strategically creating wallets and controlling the overflow, we can target specific storage slots, overwrite critical data, and eventually drain all funds.