Solidity practice
Smart contract challenges
A collection of Solidity exercises focused on security, access control, and gas efficiency.
20 of 20 challenges
- Challenge 1Low
Solidity simple bug!
Can you solve this Solidity simple bug? The name setter should update the stored value.
Solidity basicsOpen challenge - Challenge 2Low
Solidity function bug
Can you solve this Solidity function bug? Check whether the declared return type matches the returned value.
Solidity basicsOpen challenge - Challenge 3Gas
Gas-Optimized Storage
The company name and tagline never change. What is the most gas-efficient way to store these values?
Gas optimizationOpen challenge - Challenge 4Gas
Gas Optimization & Storage Refunds
What do you think the gas costs will be when setting this value to a new number and then resetting it to zero?
Gas optimizationOpen challenge - Challenge 5Info
tx.origin Misuse
The source labels this as a tx.origin access-control issue. Review the wallet's deposit and withdrawal paths.
Access controlOpen challenge - Challenge 6Info
tx.origin Misuse
Review the name registry's caller handling and compare the code with the source page's tx.origin warning.
Access controlOpen challenge - Challenge 8Low
tx.origin Misuse
Review setName and determine why a nonempty name is not stored.
State updatesOpen challenge - Challenge 9Low
tx.origin Misuse
Add numbers to an array and calculate their sum. Review the loop in the published sample.
Arrays and loopsOpen challenge - Challenge 10Info
tx.origin Misuse
Review the owner checks in this contract and compare the implementation with the source page's tx.origin warning.
Ownership checksOpen challenge - Challenge 11High
tx.origin Misuse
The owner can be changed by setOwner. What prevents an arbitrary caller from taking ownership?
Access controlOpen challenge - Challenge 12Medium
tx.origin Misuse
Review the withdrawal flow, its balance checks, and the order in which funds and accounting state are updated.
Withdrawal logicOpen challenge - Challenge 13High
tx.origin Misuse
Review the external call in withdraw. Can a recipient contract call back before its balance is cleared?
ReentrancyOpen challenge - Challenge 14High
tx.origin Misuse
The withdrawal authorization uses tx.origin. Consider how an attacker could trick an owner into calling a malicious intermediary contract.
Access controlOpen challenge - Challenge 15High
tx.origin Misuse
This wallet is intended to work behind a proxy. Review how its admin is initialized and protected.
Upgradeable contractsOpen challenge - Challenge 16Medium
tx.origin Misuse
Review how the admin role is granted and how createProposal is restricted.
Role-based access controlOpen challenge - Challenge 17High
tx.origin Misuse
Review the strategist and backup admin role grants and the authorization on sensitive operations.
Role-based access controlOpen challenge - Challenge 18Medium
tx.origin Misuse
Review activateUser. Does changing the local User value update the mapping entry?
Storage and memoryOpen challenge - Challenge 19Medium
Missing ownership check
A function can change the admin address without any authorization check. Which guard is missing?
Access controlOpen challenge - Challenge 20Low
Calldata vs memory
A function takes an array argument and later uses it in a storage-impacting way. Which data location is safer for unmodified external inputs?
Solidity basicsOpen challenge - Challenge 21Gas
Loop optimization
Review the loop and identify the gas-heavy pattern that could be avoided in a large array operation.
Gas optimizationOpen challenge