Heist Walkthrough

Challenge Statement#

Solution#

Once again, we visit the site and view the Solidity source code.

The goal here is to drain the contract’s wallet, which would cause isSolved() function to return true.

One vulnerability is that anyone can call the changeOwnership() function to become the new owner, after which we can call withdraw() to transfer all funds from the wallet.

Now, we can go back to the webpage and get the flag.

Adapted from harishkannan05/THM-HackfinityBattle-Writeup under MIT.