# BuidlGuidl CTF - Capture the Flag game | Devcon SEA

- Channel: [Devcon](https://streameth.org/devcon)
- Date: 2025-10-09
- Duration: 28:57
- Topics: Science & Technology
- Watch: https://streameth.org/watch/yt-hHVGYhRsEO0
- YouTube: https://www.youtube.com/watch?v=hHVGYhRsEO0

## Description

**Capture the Flag for Ethereum Developers (2:30 - 5:30 pm)**

Show off your Solidity skills in BuidlGuidl's CTF! 

Tackle 10+ challenges across all skill levels (beginner to advanced), and race to grab the most flags for a chance to win ETH, swag, and fully synced ETH nodes!

Open to all skill levels — join the fun! (solo or teaming up with frens)

Speaker(s): Carlos, Austin Griffith
Skill level: Intermediate
Track: [CLS] Learn How To Build On Ethereum & Capture the Flag Game, by BuidlGuidl
Keywords: Live Coding, Open Source Software, Public good

Follow us: https://twitter.com/efdevcon, https://twitter.com/ethereum, https://warpcast.com/devcon
Learn more about devcon: https://www.devcon.org/
Learn more about ethereum: https://ethereum.org/ 

Visit the https://archive.devcon.org/ to gain access to the entire library of Devcon talks with the ease of filtering, playlists, personalized suggestions, decentralized access on Swarm, IPFS and more.

Devcon is the Ethereum conference for developers, researchers, thinkers, and makers. 
Devcon SEA was held in Bangkok, Thailand on Nov 12 - Nov 15, 2024.
Devcon is organized and presented by the Ethereum Foundation. To find out more, please visit https://ethereum.foundation/

## Transcript

[Music] yo what's up I'm Austin Griffith thank you for coming to the afternoon session I've done a bunch of uh morning sessions we built a bunch of things already uh we've done too many scaffolding sessions already and this is going to be another one we are definitely like wailing on this uh beginner to intermediate content if you are a builder uh go to speedrun ethereum to learn how to build on ethereum uh this will help you with your first five apps and we're going to speedrun the speedrun today I've uh written a bunch of code this will probably be a little less code writing and more just like going through the tutorials and talking about some of the AHA moments you have along the way uh just to like Zoom all the way out we are the build Guild uh we are focus on developer education and tooling our main tool of choice is scaffold e and we use that to build a bunch of things uh but that is also the heart of speedrun ethereum which is our curriculum and we're going around the world teaching people how to build on ethereum and anybody can just go to speedrun ethereum and get started today and we're going to kind of just speedrun the speedrun today I'm going to go through the challenges and just kind of talk through the kind of the AHA moments you'll have but hopefully you can go home and speedrun ethereum on your own time and really kind kind of go through this at your own pace but I'm going to go through it quickly just to kind of cover like oh here's you know here's the stuff to look out for basically uh let's let's do just real quick if you guys could give me a show of hands how many of you have deployed a contract on mainnet before oh yeah we got five or six mainnet deploys all right how many of you have deployed on an L2 actually less I think right less people okay we're going to change that today for sure we got to get you ready for that scaffold the deployed one to base earlier and someone attacked it stole my money it was pretty fun okay how many of you are software developers okay those look at those I would say that was almost all the hands oh I just got goosebumps I'm excited okay this is awesome so I'm G to just do the speedrun probably 20 30 minutes I'm going to speedrun the speedrun uh and then I'm going to hand it off to Eda and she's going to do I think like an nft build right cool awesome okay so um just just case you've missed me shielding scaffold eth I've been shiing it all week but it's a really great tool for prototyping but also deploying to production it's really nice because you can make small changes to your smart contract and those changes are sort of represented live in your front end so you add like a new variable and boom it shows up in your front end and then say you uh set up a require statement that says only the owner can get into this function and then to go test that instead of writing and eventually you will write lots of tests but instead of writing all of those tests up front what you can do is just create a burner wallet and try it as the good guy and make sure it works and then try it as the bad guy and make sure it doesn't work scaffold e gives you that opportunity to try it and it it's lets you tinker and test your assumptions okay but today we're using scaffold eth within speedrun ethereum and let's just look we're just going to look at each one of these quests and go through these then I'll hand it out to Eda then we'll do a Q&A maybe we'll do a quick set of questions before yeah I'm going to do that I'm going to do like 20 minutes then we'll do five minutes of questions then edit will take over then there's like this Q&A thing where they put up a QR code and you shoot it and ask like anonymous questions or something but we we might get to that too at the end okay so building uh on ethereum here we go the the very first tutorial kind of points out that you probably need to have some solidity already uh if if you don't if you're a coder saw all those hands there's a lot of coders in this room it's basically everybody if you're a coder you can go to solidity by example or just go to the solidity docs and you're going to pick up the language pretty quickly you're going to pick up the primitive data types you're going to pick up the mappings and arrays but just like go through this and kind of learn these Concepts uh for instance ether verse way is a thing that we'll talk about today um there there's a few other just kind of like aha moments you have but you got to first get the syntax and so you can you can get the syntax from the docs or you can get it from solidity by example or you can just prompt cursor to write it for you too okay so uh that's the basics um also there's a web two to web 3 Series that can help you get your wallet ready and do some of those you know first beginner actions uh you know what how many people have deployed to a test Network so the main net was to okay okay okay yeah that's like 50 60% of people have deployed to a test Network that's really great Okay so with that in mind I'm probably going to double speedrun the speedrun and I don't want to like bore you guys too much and we can really get to to the heart of building something with with Eda and then after this let me make sure I show this uh the live stream will actually shut off and we're going to do a capture the flag and knowing that there are so many good devs in here already I would recommend sticking around uh it's going to start at 2:30 and it's going to go till 5:30 there's going to be these 12 Flags in this NF contract that you'll mint uh we're going to give away $11,000 in eth to the winner $500 second place 250 to third something like that I think the prizes are here uh yeah there we go but we're also going to give out we have fully synced uh ethereum nodes we have this thing called the build Guild client where you can run a build Guild you can run an ethereum node with a single line and then we've been syncing nodes ourselves and we bring them to these events so the winner will win a fully sync W and Lighthouse node not not a Staker like it doesn't have 32 eth sitting on it but it is a node that you can like run an index or against or something like that uh also also uh if you uh are interested in running one of these nodes we're looking for more node Runners uh specifically in South America Africa and Southeast Asia we only have a few of them here and we're trying to get these numbers up so come come talk to me after if you might be interested in running one of those you might just get a free node that we send you we don't have that many but we have a few that we synced and we brought we'd love to get some some more participants but that's for the CTF that starts in a couple hours uh about an hour and 10 minutes but first let's speedrun the speedrun at speedrun speeds so the the very first challenge that you'll take on with scaffold eth is just a simple nft contract you don't even have to write any code it's more about just getting your environment calibrated you'll clone down this repo you'll see the in you'll check out that first Branch I'm going to uh bring this up because I want to start looking at this stuff in git I want to have that up but it this one's super simple and it kind of goes through some of the um basic concepts that you get from scaffold eth for instance burner wallets uh you've probably heard me talking about burner wallets if you've been to any other session but they're really great for local development if you're building something locally and you need to make a bunch of transactions it's way easier if you have a local burner wallet and just every time you hit a button it just makes a transaction and you don't have to like have the popup and have the chain ID set with metamask and all that stuff so burner wallets are another one of our little secret superpowers built into scaffold eth and it has you you know go to the faucet load up your burner wallet and then I think it has you even like send it around right in scaffold eth you can open up multiple windows and since that burner wallet has a private key in local storage you can open up uh an incognito window and it's like a whole new account so if you ever need like a bad guy to try to see if he can you know do something in the only only owner block of your code you just bring up a burner wallet fund it and then go try it and then you go to your good guy and have him run and make sure it it works for them works for the good guy fails for the bad guy right that's that's how uh burner wallets are really handy built into scaffold e so I think what you do is you get in here you uh go to the faucet and you get some eth and then you go ahead and mint these silly little uh little an and then it has you send them around so you'll create another account and you'll send one of the nfts to the other one and you you just kind of it's really nice it's like this it's it's like a Goosebumps moment when you like hit send and it disappears over here and then a little Buffalo pops up over on the other one it's a lot of fun then it'll have you deploy it to I think sapoia or maybe even base sapoia optimism sapoia something like that Yep looks like sapoia there yep and I think there's even a second test net on this so you don't have to use theoa I think we have a second I think it's base theoa but I don't know yeah I don't know and there's some side quests here but that's the the first Challenge and then what you'll do is you'll hit submit challenge you'll put in your site so you're going to deploy a live site that lets people mint nfts on sapoia and you can run through this pretty quickly like a a good Builder could run through this first tutorial in like 20 minutes probably so if if you're a decent Builder you can probably dive in and actually like put an app out live with within an hour so you'll put the app URL there and then you'll put your smart contract URL there and we have an autog grader so the autog grader it it goes and it I think it downloads your contract and runs it or maybe it goes and talks to your contract on sepolia and make sure everything works correctly so each one of these challenges are autog graded with like a testing system so you can kind of like level up as you go through each challenge not really a whole lot of aha moments here it's more like we're building up the the base knowledge right so let's go to the next challenge and that would be the oh no NOP go to go to challenge one and yesterday I went through and built uh this one fully uh during a video you could go look back at that one from yesterday I think it was maybe called the same thing as this uh but yeah if you go to the Devcon schedule search Austin it's going to be like the second video there and I go through the the staking app uh but let's let's speedrun through through it right now just kind of looking at it so I think this is probably the most uh this is the most important challenge uh not I I would say the decks is the most important challenge but this is the the real like heart of it this is the beginning of like figuring out what kinds of things you want to build on chain and and what kind of things like belong on chain and I think a real aha moment you know you're you are deploying these apps that live forever they have nation state level hardness credible neutrality but it really starts to make sense to me when I think of uh an adversarial group of players trying to coordinate they want to coordinate maybe uh in this case what we're going to do is we're going to get everyone to pitch in like 0.1 eth and if we get enough eth put together then we'll be able to go do this second action like go buy this thing or invest in something right and what you need to do is build the smart contract in a way that they can't grief each other they can't steal each other's money but if they do choose to coordinate they can coordinate and I think that's a really powerful mechanism and so uh you'll you'll write this Staker doou and you'll build a stake function and you'll allow people to stake money into your contract and you'll need to keep track of each person's balance because if they don't end up coordinating correctly then you'll have to refund everybody and you need to allow everybody to be able to withdraw from the smart contract so that's kind of like starting to sink in like what kinds of things you might be putting on chain this is kind of like a coordination mechanism with people that don't totally trust each other it's slightly Financial but doesn't have to be uh but you have to write all these rules and I think one of the first aha moments for me is that none of this is automatic it's when you think of blockchain or Dows and autonomous agents you just kind of think that there's like this magic thing that is handling a whole bunch of things in the background and it certainly is a magic technology but to make something happen on chain someone has to make make the transaction happen it's it's not like the smart contract is working in the background and and and doing things right the smart contract does what it's supposed to do but someone's got to make a transaction against the smart contract to get the the the thing to work so in this uh particular build you're kind of building a state machine if we want to imagine a a a state of so there's this open Period right and there's at this point anyone can stake anyone in the world can stake in in this in this open period and then at some threshold or I'm sorry at some uh time maybe timeout I don't know what do we call it here let me make sure deadline so at some deadline you need basically the contract to be ready to go into the next state so you sort of have this open staking period and then at the deadline you set up an execute function that checks to make sure that the deadline has passed and that no one else has run execute yet and then in that execute function we need to check and see did we get enough money in the contract so there's an open Period people are yoloing in money we have some threshold that we need to get to and some deadline of time that we need to hit and once that deadline of time is hit someone's got to poke the thing and if they hit the button or they make the transaction and there's enough money in the contract we move into kind of what we'll call the Happy State where the money actually gets invested wherever we wanted to go in this case there's just like an example contract and it moves the money into the example contract and calls a function on it but that contract could be anything you're kind of just imagining that that is something more advanced maybe you're buying an nft or something more fancy but so you're open State you hit the threshold or you hit the deadline you check to see if the money is above the threshold and if it is then you're in the Happy State you move that money into the contract and you trigger the next thing but if you didn't get enough money together then you need to kind of go into the maybe the sad State or the withdraw State you some people have already yoed money in and you didn't get to the threshold so you need to basically you have this open for withdraw and the open for withdraw will is is kind of another mode and that means anybody who has put money in and now that we didn't get to the threshold and now it's withdraw time now they can get in and withdraw their money back basically and that's that's kind of how these apps work right they need to kind of think of it like a state machine you need to make it so uh we're not sending the money back to everybody they have to get in and withdraw it right because there's gas involved with that and we're not going to run that system so that's that's kind of the best the best like quick first build in ethereum like this this will be I guess if we call the nft app your first build this will be your second build and this build is really going to start Illuminating the kinds of things that you want to put on chain uh I think you end up putting it out on yeah sepolia and you basically deploy a staking app and uh you learn learn along the way so the next challenge is the token vendor this will be your third app and the token vendor uh really leans into erc20 tokens uh if you uh have ever minted an erc20 token you know that there's this transfer function but there's also this approv function and when you want to actually send a token into a smart compy contract you don't just send it and it does stuff you actually do this really weird thing where you go to the Token contract and you approve the smart contract to take the money and then you make a second transaction on the smart contract that says hey I've approved you to take my money please do so and then do some other things and so it's a kind of a complicated thing to get your mind around at first but that's what you'll do here you'll build you'll deploy your own meme coin basically and then you'll make a a vending machine smart contract that lets people buy that token at some exchange rate you'll say maybe a hundred tokens per eth and then they get in and YOLO some eth and then you send them some tokens it sounds simple but it's actually pretty tricky if you think about the different transactions that have to happen there and how these different smart contracts are interacting with each other let me see I think the approved pattern is a big one here contract to contract interaction is a big one here just just this idea that like let me I think says it right here like smart contracts are kind of like always on vending machines that anyone can access I think that's just like a really cool way to think about it it's like a vending machine in the sky that anybody can get to that's that's pretty cool and not even like nation states can censor it that's really powerful okay so uh those are your first three builds your fourth build is going to get uh a little gamly it's going to be a dice game and so dice G the dice game really shows you how Randomness on a public deterministic blockchain is kind of tricky uh you can't really get Randomness in in the way that you might think of when you just go to like hey JavaScript give me a random number right you can't get that from the evm it doesn't do that uh but what you can do and this is not a good idea you can use the previous block hash so there's a lot of entropy in the block hash because it has to do with like proof of work Mining and now it's you know validating and different but it's it's basically a random string of hex characters and so you can use that previous block hash for a very insecure form of Randomness and there's really cool ways to do Randomness on chain with oracles and uh other ways that even like we have this really cool way where you submit a previous header and it uses the block difficulty which is now randow so there are like very good ways to do Randomness uh this is not one of them this is a bad this is a bad way to do Randomness basically the way it works here is you're going to put in like 0.1 eth and it's going to roll the dice basically just looking back at the previous block hash and doing a mod of that you know like mod six and it's like a one die roll right but if you win you'll win like 6X back if you lose your money stays in the contract and you can play the app and you could probably load it up with some eth and it would play for a long time but this thing is attackable you can attack this by creating a second uh attack contract I think it's called rigged roll is what we called it yeah you build a rigged contract and the way this works is the Smart contract knows about the other smart contract and knows how it's deciding it knows okay if we're on block eight we know that this guy's going to be looking at block seven and doing a mod six on it or something like that so you basically recreate that math in your R rigged contract and then when you go to roll you basically only roll if it's a winner and so you can basically drain the dice contract with this rigged contract and and that'll be your uh third or fourth build that'll be your third build where are we at here that'll be your fourth build all right let me see if there's any other little aha moments in here that I want to talk about a really fun game though you get to roll this die like you got all these cool this scaffold e makes it look cool and the build Guild team has done a really good job designing this making it look nice and making it flow really smoothly some side quests in there looks like you end up deploying IT contract verification looks good go do this at home you'll learn you'll learn a lot all right the fifth app and I think the most important uh and then I can hand it off here in a little bit it's a DEX and a DEX is um a way to swap it's a decentralized exchange it's a way to swap between some token and eth or maybe token to token but the way this worked before was like an order book system if you wanted to swap with someone someone would sign a message that they they would be the maker and then they would they would be looking for a taker right and the maker would say something like I have five of these tokens and I would like one eth and I've signed a message and that goes into an order book and then someone else could take that submit that message and submit it on chain and send their tokens in and get the eth back right so you could swap but there's like this centralized order book there and that order book can get down go down that order book could get regulated there's a lot of reasons why the centralization sort of falls apart you have this really awesome decentralized blockchain and then you're you know running this centralized service on top of it so uh the Dex brings this all on chain it makes it uh fully decentralized and really the the the trick here is to have reserves of both loaded up in the contract so what you do is you'll put in a whole bunch of tokens and a whole bunch of eth at the ratio of whatever those tokens are worth and then when people want to swap they'll swap much smaller amounts between the two and there's a really nice kind of like drawing in here you'll see the constant product stuff uh what this thing right here this thing right here so I'm going to put in token a and get back token B right and that curve is the price curve and with each trade the sort of dot moves up and down that curve and there's a really nice visual uh uh uh curve here it actually like plots this for you let me see if I can find it where is that thing yeah well here it is but it's not there oh wait is that a video no that would be cool uh you you'll see this curve and you'll see it move up and down and as you swap you know if I put in a whole bunch of tokens it's going to run down the line and if I put in a whole bunch of eth it's going to go up the curve and and the price is wherever that dot is and the amount of slippage is how far that kind of triangle comes out it's you kind of have to dink around with it but once you start dinking around with it and shaffle E it's like it it becomes pretty obvious how this works so your your fifth app the most important app is this Dex and what you do is you build a smart contract and you have to write the code you have to figure out how to set up the Swap and how to make it uh figure out based on the reserves what the price is and uh you have to uh like really write the code and learn and you'll have to get in here and do this it takes the time it takes a little bit of time by the way this Dex doesn't have slippage protection don't deploy this uh on you know on Main net or something this is like a play Play De you need to build more things into it to make it secure to put uh online on chain but it's it's good enough for you to learn here yeah here's how you calculate the price right there's this constant product where you figure out the the token to eth mixture and then like there's the token to eth on the way in and then the token to eth on the way out and they have to basically be equal okay so uh you the there's the swap right you can go from token to eth or eth to token but there's also a couple more functions on your decks and they're around putting these reserves in you need to basically load it up with tokens and load it up with eth and when you do that you get minted another token that represents your claim on the reserves that you're storing in that contract and this is a really important concept because what's going to happen here is that the reserves are going to earn you money if you own eth in that contract you have that token that represents that money as people swap like 03 or something like that of that token gets left behind each time so actually if you look at a DEX with reserves in it if someone swaps back and forth a bunch of times the deck sort of slowly gains value it actually earns fees so for you as the liquidity provider you're earning fees and this is what's called expansive in in the term of hyper structure so I want to hit you up with this one uh go look up a hyper structure and spend some time uh reading this this paper because it's really inspiring and it helps uh kind of lean you toward building on chain and thinking about how you put things on chain and what kinds of things can be successful on chain uh it need to be unstoppable free valuable expansive that's what I was talking about about the LPS why would someone want to lock up all this money like the more reserves you have the better the swap is is uh but what's my incentive for doing so right you have to incentivize folks uh it's permissionless it's positive sum it's credibly neutral check out check out a hyper structure so yes you will create the smart contract you'll be able to do eth to tokens tokens to eth you'll be able to put liquidity in you'll kind of like learn all these intricate details there there's the curve right there I knew it was here somewhere and uh you'll end up shipping this to a test net and you can just get in there and swap you can get in there and put put liquidity in pull liquidity out it's really like a little sandbox Dex that's you know the the starter kit for building something like uniswap okay so those are your first five apps you want to go speedrun these uh we are always in the telegram channels there's a telegram channel for each one we're in there answering questions so if you have questions we're there and we can um yeah yeah help you speedrun those if you have any questions I think the last few challenges let's just go look at those real quick just so I can highlight those uh you you get to join the build Guild once you complete the decks and that's basically we have like onboarding batches we do a small grants program we basically prepare you to go ship something in the space uh State Channel application looking at signatures looking at l2s looking at offchain interactions a multisig wallet would be having multiple signers that could all transact or you need maybe like two out of three signers to be able to make a transaction happen so this is really nice if you need like something more secure uh a lot of good developers in the room I've seen that if you're holding e in large amounts you want to have it in a multisig right you don't want to have it in uh like an app or a hot wallet you want to have it in a smart contract that has rules based on you know if uh if if you want to move money out of this smart contract I'm going to need a signature from your phone phone and I'm going to need a signature from your laptop and I'm going to need like a signature from your Hardware wallet right you have to get all of those together or maybe two out of three of those together to make the transaction happen and that's just much safer it keeps the money safer locked up in the smart contract wallet in the multisig and then the last one is a fun little just like SVG nft we started out with that first nft and you'll get in here and you'll learn about ipfs and you'll realize that like the thing gets deployed to ipfs and the only thing that goes on chain ends up being the link to the ipfs so the thing that's on chain is more like a little Json file that tells you where the the stuff is you're not actually putting the image on chain so in this last challenge we actually have you make an nft where the actual SVG nft is rendered from the smart contract which is probably more nerdy than anything but it's just cool to do and it'll be a good lesson to learn so that was like a bonus basically your first five apps go up to the decks and the rest of these are kind of bonus uh challenges but I would recommend you take time to go through them when you have some free time at home or maybe just some free time uh around here but you'll have to sit down and focus and actually write code there there's a lot of moments where you have to think for yourself it'll say hey you need to do you need to you know make this thing happen but there's not going to be code that you can copy paste you'll have to write the code yourself it it gives you lots of help but in the moment of figuring it out like you have to figure it out yourself and that's it's it's going to help you learn like that's the way to learn this okay so that's speedrun ethereum uh I'm Austin Griffith we're the build Guild uh we are going to uh do this CTF after this but I think Eda is going to come up and um do some nfts next you going to do an nft app awesome okay and I don't want to close my laptop but I'm good to go when you guys are good yes thank you thank you I should