Skip to content

Recover the Burning Ring of Fire

Objective 14: Buy a Hat

Hints

You should have been given a target address and a price by the Hat Vending machine. You should also have been given a Hat ID #. Approve the transaction and then return to the Hat Vending machine. You'll be asked to provide the Hat ID and your wallet address. Complete the transaction and wear your hat proudly!

Before you can purchase something with KringleCoin, you must first approve the financial transaction. To do this, you need to find a KTM; there is one in the Burning Ring of Fire. Select the Approve a KringleCoin transfer button. You must provide the target wallet address, the amount of the transaction you're approving, and your private wallet key.

To purchase a hat, first find the hat vending machine in the Burning Ring of Fire. Select the hat that you think will give your character a bold and jaunty look, and click on it. A window will open giving you instructions on how to proceed with your purchase.

Wombley Cube

Hey there! I'm Wombley Cube. It's so nice to see a friendly face.
What's an elf doing all the way down here with all these sporcs, you ask?
I'm selling snazzy, fancy-pants hats! You can buy them with Kringlecoin.
The reason I set up shop here is to gather intel on that shady Luigi.
I'm a member of the STINC: Santa's Team of Intelligent Naughty Catchers.
He and his gang are up to no good, I'm sure of it. We've got a real Code Brown here.
Purchase a hat so we look inconspicuous, and I'll clue you in on what we think they're scheming.
Of course, have a look at my inventory!
Oh, and if you haven't noticed, I've slipped hints for defeating these Sporcs around the tunnels!
Keep your eyes open, and you'll find all five of them. Wait, maybe it's six?

Well I looked through the hats. Seen tophats and was like alright white hat it is!

Use a KTM to pre-approve a 10 KC transaction to the wallet address: 0x5752CD031d7f09fCc804E58e210A4373513a0020 Hat ID: 18

Answer

Find a Hat, Go to KTM, Approve, Back to Vender and Purchase

Wombley Cube

Nice hat! I think Ed Skoudis would say the same. It looks great on you.
So, here's what we've uncovered so far. Keep this confidential, ok?
Earlier, I overheard that disgruntled customer in the office saying he wanted in on the "rug pull".
If our suspicions are correct, that's why the sporcs want an invite to the presale so badly.
Once the "Bored Sporc Rowboat Society" NFTs officially go on sale, the sporcs will upsell them.
After most of the NFTs are purchased by unwitting victims, the Sporcs are going to take the money and abandon the project.
Mission #1 is to find a way to get on that presale list to confirm our suspicions and thwart their dastardly scheme!
We also think there's a Ring hidden there, so drop Mission #2 on them and rescue that ring!
Thank you for your business, dear customer!

Palzari

Hello, dear. Come down to visit your tiddly elf friend?
You two are just adorable, playing hero and braving our flaming domain.
Sure, we'll tolerate you playing here, but please behave, won't you?
Use this KTM to buy your darling little hats, and nothing more. If you decide to be a brat, well...
I'll disappear you into the Devnull Chasm, and nobody will ever see you again. Do we have an understanding?
Very good. Run along now, dear.

Objective 15: Blockchain Divination

Hints

Find a transaction in the blockchain where someone sent or received KringleCoin! The Solidity Source File is listed as KringleCoin.sol. Tom's Talk might be helpfu

Look at the transaction information. There is a From: address and a To: address. The To: address lists the address of the KringleCoin smart contract.

Slicmer

Don't bug me, kid. Luigi needs me to keep an eye on these offers you can't refute.
The boss told me to watch them for any shifty transactions from wallets that aren't on the pre-sale list.
He said to use this Block Explo... Exploder... thing.
With this, I can see all the movement of the uh... non-fungusable tokens.
Once on the blockchain, it's there forever for the whole world to see.
So if I spot anything that don't look right, I can let Luigi know, and Palzari will get to the bottom of it.
So if I spot anything that don't look right, I can let Luigi know, and Palzari will get to the bottom of it.
She looks sweet, but she's actually the boss' enforcer. Have you talked to her yet? She even scares me!
It sure would be fun to watch you get on her bad side. Heh heh.

Question

Use the Blockchain Explorer in the Burning Ring of Fire to investigate the contracts and transactions on the chain.<br>
At what address is the KringleCoin smart contract deployed? Find hints for this objective hidden throughout the tunnels.<br>
The way blockchain works is there's a trackable history of it. So we can look all the way back to #0 and find the contract address there.

Answer

0xc27A2D3DE339Ce353c0eFBa32e948a88F1C86554

Objective 16: Exploit a Smart Contract

Hints

You're going to need a Merkle Tree of your own. Math is hard. Professor Petabyte can help you out.

Chorizo

Do you not have the slightest inclination of who I am?
How did I, Count Chorizo, Herald of Rrrrepugnance, not receive an invitation to the presale?
I could purchase every one of your wares, but now you shan't have a single cent from me!
I will see to it that you nevah do business in these warrens agayn!

Luigi

Psst. Hey, slick - over here. Myeah.
You look like a sucker ahem I mean, savvy.
I got some exclusive, very rare, very valuable NFTs for sale.
But I run a KringleCoin-only business. Kapeesh?
Ever buy somethin' with cryptocurrency before?
Didn't think so, but if you wheel and deal with ya' pal Luigi here, now you can!
But we're currently in pre-sale, and you gotta be on the list. Myeah, see?
BSRS NFTs are a swell investment. They'll be worth a pretty penny, and that's a promise.
So when they're purchasable, you better snatch 'em up before the other boneheads ahem I mean, eggheads do.
I got a business to run. You can't buy nothin' right now, so scram. Kapeesh?

Objective 16

Once you've confirmed everything works and you're sure you have the whole validated-and-on-the-list thing down, just go find a KTM and pre-approve a 100 KC transaction from the wallet you validated. That way, the funds are ready to go. Our Wallet Address is 0xe8fC6f6a76BE243122E3d01A1c544F87f1264d3a.
Investigating the terminal we see a pre-sale page.<br>
The hint and talk touches on Merkle. I found a github repo with a generator. I tossed in my key and ran a null root key against it to get the proof id. Turns out that when looking through the traffic in BurpSuite the code is looking for a specific root. It's getting passed in the request. So if we pass our root in a request then we get validated as being on the list.

We need to go to KTM and approve a 100 KC transcation now to 0xe8fC6f6a76BE243122E3d01A1c544F87f1264d3a. Once thats done we can repeat the interception passing our root and bingo!
I generated my own NFT!

Answer

Intercept the request and trick it into allowing you to purchase an NFT
https://boredsporcrowboatsociety.com/TOKENS/BSRS247

Slicmer

Hmph... this is so boring...
"This is a serious task" he said, "not a sporc headbutting-party" he said.
"Mess this up, Slicmer, and I'll tie a rock to your feet and throw you down a well!" he said.
I think this job was just to keep me out of his way. Luigi thinks I'm a blockhead.
Well I think he's a -- Huh? Wait a minute...
Hey! Boss! I think I see somethin'!

Luigi

What!? How'd you get on the list? What's that? You's a double agent, and you're actually workin' for us?
I don't know if I buy that, but you're on the list, so... myeah.
Somethin' about this ain't sittin' right with me, but there's no reversing transactions with cryptocurrency.
That NFT is yours to keep, but if I find out you're lyin' to me, Palzari's gonna pay you a visit. Kapeesh?

Chorizo

Well...I...never...
How was a plebeian such as yourself granted access to the pre-sale?
I present thee with a proffer to purchase the NFT you've acquired for twice the price.
Hwhat? You shan't vend to me? Have you any idea who I am?
You just refused the abhorrent Count Chorizo!
I shall ensure you are nevah able to transact with that NFT agayn!

...

Ruh roh! Think we pissed off Grinchum

Grinchum

πŸ₯Ί Four Preciouses - lost!
😫 Noooo... grinchum..grinchum
😐 ..... naggy human doesn't only want coinses and hatses.
...What... 🀨has it got...
😠 in its silly, little, badges!?
😧Stole them... 😠 You STOLE them!
😑 Raaaargh!! We will make sure naggy human never takes our last Precious!
😠 We wants them... we needs them... Must.. have.. the Preciouses.
They stole them from us, sneaky little humanses.
πŸ™‚ No, not the humanses, they're my friends.
😏 You don't have any friends. NOBODY likes YOU. You're a liar, and a thief, and a.... grriiiiiiinch.
😒 Go away... we don't need you anymore. The humanses protect us now.
😠 Go away? I protected us. The preciouses are safe because of ME!
πŸ™‚ Leave now, and never.. come back. πŸ˜ƒ Leave now, and never.. come back!
😁LEAVE NOW, AND NEVER.. COME BACK!😬
Friendly human, please go to jolly human's castle! Go on, we will meet you there!

Wombley Cube

You've done your duty, agent.
Excellent work, especially on Mission #2! I'll log this entry back at STINC HQ.
Keep doing work like this, and you'll be sitting on the STINC throne, leading the agency someday.
Nobody will know of the job you did here today, but the STINC thanks you.
I'm just being dramatic, everyone's gonna know how awesome you are!

Palzari

Tsk tsk tsk, I thought I told you to play nice?
The only reason you're not in time-out is because Luigi doesn't seem convinced that you're a little rascal.
He's not as clever as he likes to think. But once he comes around...
You better watch out, dear. And when I catch you, you better not cry. Or do, not even Santa will hear you.