S1C4: Who Can Sign This? #

1. Problem #

The contract requires the caller to provide an ECDSA signature to prove their identity. The mintFlag function checks whether the signature was issued by a specific authorized signer.

2. Root Cause #

The contract uses ECDSA signature recovery (ecrecover) to verify the caller. The signature must be issued by a hardcoded authorized signer address. You need to find the signer's private key or obtain a valid signature through other means.

3. Solution #

1. Read the authorized signer address from the contract's storage
2. Derive the signer's private key using the well-known Hardhat default mnemonic (index 12)
3. Sign a message with that private key
4. Submit the signature to mintFlag

// Using ethers.js to sign
const signer = ethers.Wallet.fromMnemonic(hardhatMnemonic, "m/44'/60'/0'/0/12");
const signature = await signer.signMessage(messageHash);

4. Pitfalls Encountered #

Signer private key source: Different documentation may point to different derivation paths or mnemonics.

5. Why the Pitfall Exists #

Hardhat's default mnemonic account index 12 corresponds to the address 0xFABB0ac9d68B0B445fB7357272Ff202C5651694a, which is the address used by the CTF deployer as the authorized signer.

6. How to Resolve #

Verify that the signer address matches the authorized signer stored in the contract:

cast storage <CHALLENGE> <SIGNER_SLOT>

Use the correct mnemonic and derivation path to generate the signature.

7. Key Takeaways #