Lesson pack 27 · Advanced · 90 minutes
Smart contracts and the EVM
Public code, public state, and an execution model where a callback in the middle of your function is a normal event.
Print this page for a paper plan - the navigation and links drop out.Student-facing version
Before the session
- Nothing to install. Students need a browser and https://ctfpal.com. Confirm the room can reach it once; after that it works offline.
- Read the lesson yourself first - about 12 minutes.
- Have one worked example ready to paste. The classroom link builder on the instructor page turns it into a URL that opens preloaded.
Objectives
Written as things a student can do afterwards, so they can be assessed rather than asserted.
- Read contract storage directly and explain why 'private' means unindexed rather than secret
- Trace a reentrancy path and name the state update that happened too late
- Distinguish delegatecall from call in terms of whose storage is written
- Recognise an unprotected initialiser or owner-setting function from the bytecode alone
- Follow a transaction trace to the exact call that changed the balance
- Explain why an on-chain source of randomness is an attacker-observable value
Running order (90 min)
| Time | What happens |
|---|---|
| 0:00-0:09 | Frame the problemWhat the category looks like when you meet it cold, and why the naive approach fails. |
| 0:09-0:27 | Teach the methodThe technique itself, on the board or from the lesson. No tools open yet. |
| 0:27-0:50 | Demonstrate liveSame technique, in the workspace, on your worked example. Narrate every choice. |
| 0:50-1:21 | Practice setStudents work the challenges. Circulate rather than present. |
| 1:21-1:30 | Checkpoint and wrapCollect the artefact, name what comes next. |
Tools used
- EVM bytecode analyzer: disassemble, decode selectors, read storage - Disassemble Ethereum contract bytecode, resolve function selectors, decode ABI calldata, and read a storage slot the way Solidity packs it.https://ctfpal.com/?tool=evm-contract-analyzer
- Hex to text converter - Convert hexadecimal to text and back, tolerating whitespace, commas, and `0x` prefixes. Runs entirely in your browser.https://ctfpal.com/?tool=hex-decoder
- MD5, SHA-1 and SHA-256 hash generator - Compute MD5, SHA-1, SHA-256, SHA-384, and SHA-512 of any text in the browser, using Web Crypto. Nothing is sent anywhere.https://ctfpal.com/?tool=hash-generator
- Struct pack and unpack (p32, p64, u32, u64) - Convert integers to little-endian byte strings and back at 8, 16, 32, and 64 bits - the pwntools p32/p64 helpers without the install.https://ctfpal.com/?tool=struct-pack-unpack
Reading
- Smart contract challenges: reentrancy, storage, and the EVM - 7 min. Blockchain CTF without the jargon. Reading a contract you only have bytecode for, the storage slot that is public whether or not the variable is, reentrancy and delegatecall, and why on-chain randomness is never random.
- Thinking like the designer: finding the intended flaw - 5 min. The hardest CTF challenges have no memory-corruption and no injection - just a system whose logic can be bent. Threat modeling from the attacker's chair: trust boundaries, assumptions, and the questions that find a logic bug.
Practice set
Real picoCTF challenges tagged with this module’s techniques, easiest first. Assign the first three in class and the rest as homework.
- Access_Control - picoCTF 2026, medium
- Smart_Overflow - picoCTF 2026, medium
- Front_Running - picoCTF 2026, hard
- Reentrance - picoCTF 2026, hard
Checkpoint (gradeable)
Given a vulnerable contract, drain it in a single transaction and write down the call sequence, marking the exact point where the contract's own state was stale.
Deliberately a produced artefact rather than a quiz question: it is either there or it is not, which makes it fast to mark and hard to bluff. Every tool in ctfpal is deterministic, so two students who did the work correctly hand in the same value.
Where the room gets stuck
The mental model that unlocks this module is that an external call is a yield point. Draw the stack for a reentrant withdraw once, with the balance update below the call, and the whole bug class becomes obvious rather than exotic.
- Reading `private` as confidential. Storage is public by construction; the keyword only stops other contracts reading it through the compiler.
- Looking for the bug inside a single function. Most of these are ordering bugs across an external call, which is why checks-effects-interactions exists as a rule.
- Using block values as randomness in your own solution and then being surprised the challenge does the same. Miners and callers can both see them before they commit.
- Reading a successful transaction as the state change you wanted. A call that reverts inside a try block, a fallback that silently accepts, and a transfer that returns false instead of throwing all produce a receipt marked successful.
- Testing only against a freshly deployed copy. The challenge's contract has a live history - who initialised it, which balances exist, what has already been called - and that accumulated state is frequently the whole vulnerability.
If a student wants the subject, not the answer
Chapter-level references, so a student can be pointed at twenty pages rather than at a book. Nothing here is required to complete the module.
- Designing Secure Software, Loren Kohnfelder. Chapter 10, Untrusted Input. A contract's caller is untrusted input that can run code, which is the framing that makes reentrancy ordinary.
- Designing Secure Software, Loren Kohnfelder. Chapter 6, Secure Design. Invariants and trust boundaries, which is what a contract audit is checking and what a CTF contract violates on purpose.
If you finish early
- Hand out a challenge from the cross-CTF index in this category - each one has published solutions to compare afterwards.
- Run the same input through Identify and let the class argue with the ranking. Disagreeing with a confidence score is where the technique actually lands.
- Ask a student to break their own example - construct an input that defeats the tool, and explain why.
Take this into a room
Markdown files, built here in your browser. They print, they open in anything, and they carry the challenge text - so the session works with no network in the room.