Code update from SI: thank you

README.md

@@ -1,10 +1,8 @@
-# DCTF v0.1
+# DCTF v0.2
 
 The first decentralized CTF engine, used by CCTF
 
-Testnet deployment on Moonbase Alpha: https://moonbase.moonscan.io/address/0x70f0cec3c99103113d96ed8ad82ae6a8d9a735a0#code
-
-Testnet Hall of Fame on Moonbase Alpha: https://moonbase.moonscan.io/address/0xb70780843be242474025f185bf26dddadfc27f43#code
+Deployment: TBA
 
 Main team contributors: six, Silur, Bazsi
 
@@ -14,11 +12,10 @@ Hackathon contributors: SI, username, Anon, GuyFromUniversity, ZK, Metafaka team
 
 - Finish the Vault
 - Finish the Hall of Fame with multi-management DAO style setup (approval needed for valid flag?)
-- Architect the topology, research best way so all features work together
-- Check and fix FE - contract integration, partially done, we need remote removals
+- Check and fix main FE - contract integration, partially done, we need remote removals
 - Add FE missing functions
 - Re-architect in a way we don't need to redeploy
-- Deploy version X
+- Get version X ready
 
 # Workshop at Hacktivity 2023
 

contracts/DCTF.sol

@@ -1,10 +1,6 @@
-// SPDX-License-Identifier: Apache-2.0
-// Authors: Anonz team, developed at Polkadot Metaverse Championship, as part of their CCTF track solution.
-// Based on Six's and Silur's CCTF 2022 code.
-// Currently taken from and being hacked: https://git.hsbp.org/money36/PCM_CCTF_challenge/src/branch/main
 pragma solidity ^0.8.17;
 
-contract CryptoCTFX {
+contract CryptoCTF10 {
   enum PlayerStatus {
     Unverified,
     Verified,
@@ -37,7 +33,7 @@ contract CryptoCTFX {
   }
 
   struct Challenge {
-    address obscuredFlag; // Essentially the public key of the flag, the flag being a private key
+    address obscuredFlag; // essentially the public key of the flag, the flag being a private key
     uint worth;
     uint256 descriptionFingerprint;
     bool onlyFirstSolver;
@@ -59,38 +55,26 @@ contract CryptoCTFX {
   event ChallengeAddedOrUpdated(uint contestID, uint indexed challengeID);
   event ChallengeSolved(uint contestID, uint indexed challengeID, address indexed solver);
 
-  /* CTF Manager functions */
-
-  // 1. Create a contest
   function createContest(uint contestID, string memory password) external {
     require(contests[contestID].admin == address(0), "This contest ID has already been registered");
     contests[contestID].admin = msg.sender;
     contests[contestID].password = password;
   }
 
-  // 2. Set the contest's deadline
-  function setContestDeadline(uint contestID, uint256 deadline) external onlyExistingContest(contestID) onlyAdmin(contestID) {
-    contests[contestID].deadline = deadline;
-  }
-
-  // 3. Add the public keys of the challenges and their relevant data
-  function addOrUpdateChallenge(uint contestID, uint challengeID, address obscuredFlag, uint worth, uint256 descriptionFingerprint, bool onlyFirstSolver, string memory skill) external onlyExistingContest(contestID) onlyAdmin(contestID) {
-    require(obscuredFlag != address(0), "The obscured flag value must not be 0");
-    contests[contestID].challenges[challengeID] = Challenge(obscuredFlag, worth, descriptionFingerprint, onlyFirstSolver, skill);
-    emit ChallengeAddedOrUpdated(contestID, challengeID);
-  }
-
-  function setPlayerStatus(uint contestID, address player, PlayerStatus status) external onlyExistingContest(contestID) onlyAdmin(contestID) {
-    contests[contestID].players[player].status = status;
-  }
-
   function setAdmin(uint contestID, address newAdmin) external onlyExistingContest(contestID) onlyAdmin(contestID) {
     require(newAdmin != address(0));
     contests[contestID].admin = newAdmin;
   }
 
+  function setContestDeadline(uint contestID, uint256 deadline) external onlyExistingContest(contestID) onlyAdmin(contestID) {
+    contests[contestID].deadline = deadline;
+  }
 
-  /* CTF Player functions */
+  function addOrUpdateChallenge(uint contestID, uint challengeID, address obscuredFlag, uint worth, uint256 descriptionFingerprint, bool onlyFirstSolver, string memory skill) external onlyExistingContest(contestID) onlyAdmin(contestID) {
+    require(obscuredFlag != address(0), "The obscured flag value must not be 0");
+    contests[contestID].challenges[challengeID] = Challenge(obscuredFlag, worth, descriptionFingerprint, onlyFirstSolver, skill);
+    emit ChallengeAddedOrUpdated(contestID, challengeID);
+  }
 
   function register(uint contestID, string memory password) external onlyExistingContest(contestID) {
     require(contests[contestID].players[msg.sender].status == PlayerStatus.Unverified, "You are already registered or banned in this contest");
@@ -98,7 +82,10 @@ contract CryptoCTFX {
     contests[contestID].players[msg.sender].status = PlayerStatus.Verified;
   }
 
-  // You can use six's eth_keygen to generate the signature
+  function setPlayerStatus(uint contestID, address player, PlayerStatus status) external onlyExistingContest(contestID) onlyAdmin(contestID) {
+    contests[contestID].players[player].status = status;
+  }
+
   function submitFlag(uint contestID, uint challengeID, bytes memory signature) external onlyExistingContest(contestID) onlyExistingChallenge(contestID, challengeID) onlyOpen(contestID) {
     require(contests[contestID].players[msg.sender].status == PlayerStatus.Verified, "You are unverified or banned in this contest");
     // the correct signature is an ECDSA signature where (1) the message (hash) is the sender address and (2) the private key is the flag;
@@ -117,7 +104,6 @@ contract CryptoCTFX {
     emit ChallengeSolved(contestID, challengeID, msg.sender);
   }
 
-  /* CTF ECDSA related functions */
   function recoverSigner(bytes32 messageHash, bytes memory signature) public pure returns (address) {
     (bytes32 r, bytes32 s, uint8 v) = splitSignature(signature);
     return ecrecover(messageHash, v, r, s);
@@ -132,7 +118,6 @@ contract CryptoCTFX {
     }
   }
 
-  /* CTF View functions for feedback and FE */
   function getContestDeadline(uint contestID) external view onlyExistingContest(contestID) returns (uint256) {
     return contests[contestID].deadline;
   }
@@ -144,4 +129,4 @@ contract CryptoCTFX {
   function getPlayerScore(uint contestID, address player) external view onlyExistingContest(contestID) returns (uint) {
     return contests[contestID].players[player].score;
   }
-}
+}

flag_encoder_fe/index.html

@@ -0,0 +1,65 @@
+<!DOCTYPE html>
+<html>
+	<head>
+		<meta charset="utf-8"/>
+		<title>CryptoCTF zero-knowledge flag-submission encoder v0.5</title>
+		<script type="text/javascript" src="bn.js"></script>
+		<script type="text/javascript" src="nano-ethereum-signer-mod.js"></script>
+	</head>
+
+	<body>
+
+	<label for="inp-contestant-address">contestant's address:</label> <input id="inp-contestant-address" type="text" size="42" maxlength="42" pattern="0x[0-9a-fA-F]{40}" required placeholder="0x0000000000000000000000000000000000000000" autocomplete="cryptocurrency address" title="The cryptocurrency address of the contestant who is submitting the flag. It will be used as the message that is signed using an ECDSA signature scheme. It is incorporated to prevent submission forgery and theft. The resulting signature will be accepted by the CCTF smart-contract from only this address."/> <input id="inp-only-checksum-address" type="checkbox" checked autocomplete="checksum address" title="As an optional mechanism for protection against typos in the contestant's address field, this control panel can be set to reject an address value that fails the checksum test."/> <label for="inp-only-checksum-address">only accept correct checksum address</label><br/>
+	<label for="inp-flag">flag:</label> <input id="inp-flag" type="text" size="48" pattern="CCTF\{[ -~]*\}" required placeholder="CCTF{…}" autocomplete="flag" title="The flag for the challenge in question: a piece of data that can be found through solving the problem. It can be an outstanding character sequence of the form CCTF{…} that can be stumbled upon; otherwise its location/calculation (e.g. the deciphered message) and its formatting (e.g. hexadecimal) are precisely specified, and formatting always includes enclosing by CCTF{…}. The flag will be used as the secret key for signing using an ECDSA signature scheme." accesskey="f"/> <label for="outp-obscured-flag">⇒ obscured flag: </label><input id="outp-obscured-flag" type="text" size="42" maxlength="42" readonly title="The obscured flag: data to allow zero-knowledge verification of knowledge of the flag. It is the elliptic-curve public key related to the flag as the private key. It is the thing to be loaded into the CCTF smart-contract for the respective challenge."/><br />
+	<label for="outp-signature">⇒ signature: </label><input id="outp-signature" type="text" size="132" maxlength="132" readonly title="The signature: a zero-knowledge proof of knowledge of the flag, bound to the given address. It's an ECDSA signature of the address as the message (hash) with the flag as the key. It is to be passed to the CCTF smart-contract's flag submission function."/><!--<br />
+	<label for="inp-contract-address">CCTF smart-contract address:</label> <input id="inp-contract-address" type="text" size="42" maxlength="42" pattern="0x[0-9a-fA-F]{40}" placeholder="0x0000000000000000000000000000000000000000"/><br/>
+	<label for="inp-contest-id">contest ID:</label> <input id="inp-contest-id" type="text" size="66" pattern="0x[0-9a-fA-F]+|[0-9]+" placeholder="0x0000000000000000000000000000000000000000000000000000000000000000"/><br/>
+	<label for="inp-challenge-id">challenge ID:</label> <input id="inp-challenge-id" type="integer" size="4" placeholder="0" accesskey="c"/>-->
+
+	<script type="text/javascript">
+		var inpContestantAddress = document.querySelector("#inp-contestant-address");
+		var inpOnlyChecksumAddress = document.querySelector("#inp-only-checksum-address");
+		var inpFlag = document.querySelector("#inp-flag");
+		var outpObscuredFlag = document.querySelector("#outp-obscured-flag");
+		var outpSignature = document.querySelector("#outp-signature");
+		var secp256k1n = new BN('115792089237316195423570985008687907852837564279074904382605163141518161494337', 10);
+
+		function getPrivateKey() {
+			var s = inpFlag.value;
+			var h = "0x";
+			if (s.slice(0, 5) !== "CCTF{" || s.slice(-1) !== "}")
+				return null;
+			for (i in s) {
+				var c = s.charCodeAt(i);
+				if (c < 32 || c > 126)
+					return null;
+				h += c.toString(16).padStart(2, "0");
+			}
+			return "0x" + new BN(keccak256(h).slice(2), 16).mod(secp256k1n.sub(new BN(1))).add(new BN(1)).toString(16).padStart(64, 0);
+		}
+
+		function updateOutputValues(ev) {
+			var k = getPrivateKey();
+			if (k === null) {
+				outpObscuredFlag.value = "";
+				outpSignature.value = "";
+			} else {
+				outpObscuredFlag.value = addressFromKey(k);
+				var m = inpContestantAddress.value;
+				if (!/^0x[0-9a-fA-F]{40}$/.test(m) || inpOnlyChecksumAddress.checked && m !== addressChecksum(m)) {
+					outpSignature.value = "";
+				} else {
+					outpSignature.value = signMessage(m, k);
+				}
+			}
+		}
+
+		inpContestantAddress.oninput = updateOutputValues;
+		inpOnlyChecksumAddress.oninput = updateOutputValues;
+		inpFlag.oninput = updateOutputValues;
+
+		updateOutputValues();
+	</script>
+
+	</body>
+</html>