tl;dr: buy all acceleration, recursively call monaco.play(1), win. onemanbandplus2 consists of Brock Elmore @ Nascent, Plotchy (independent), and 0xalpharush @ Trail of Bits Context 0xMonaco is a game in which many players compete against each other in a smart contract "race". Each car in the race is a smart contract created by a competitor, with 3 cars in each race. The goal is to get your car to distance 1000 before your competitors do. To do so, there are 2 resources a car can buy: acceleration shells Acceleration is exactly as it sounds: it increases your car's speed. Shells on the other hand, can shoot forward and change the car in front of your's speed down to 1.

lockbox2.t.sol // SPDX-License-Identifier: MIT pragma solidity ^0.8.4; import "forge-std/Test.sol"; import "../src/lockbox2/public/contracts/Setup.sol"; import "../src/lockbox2/public/contracts/Exploit.sol"; bytes constant SIXTY_FOUR_ZEROS = "0000000000000000000000000000000000000000000000000000000000000000"; // ctrlc+v on handcrafted calldata

New Challenge Setup Script #! /usr/bin/env bash # chmod +x copy_challenge.sh # ./copy_challenge.sh NewChallengeName preamble=/home/plotchy/code/ctf/paradigmctf-2022 cp $preamble/test/TestTemplate.t.sol $preamble/test/$1.t.sol cp $preamble/script/ScriptTemplate.s.sol $preamble/script/$1.s.sol mkdir -p $preamble/src/$1/public/contracts

This was just me getting used to hackmd. Cant find delete button lol You send runtime bytecode to setup.challenge().deploy() will be grabbed from rever.etk using vm.ffi and ./script/compile.sh Example inputs find string through cast --format-bytes32-string <string> or https://www.rapidtables.com/convert/number/ascii-to-hex.html "paradigm"