Skip to main content

Move on IOTA Capture The Flag (CTF)

The Move on IOTA Capture The Flag (CTF) is a unique learning experience designed to help developers master the Move programming language by solving a series of challenges. These challenges simulate real-world scenarios that require participants to find and exploit vulnerabilities, optimize contract logic, and interact with IOTA’s Testnet. Whether you're new to Move or experienced with smart contract development, this CTF is an excellent way to sharpen your skills.

This CTF features eight challenges, each built on Move, a language optimized for safety and scalability in decentralized applications. Throughout the event, participants are encouraged to explore Move’s features, including its resource-based design and transaction scripting model, in a competitive environment. However, bear in mind that the provided demonstration contracts may intentionally include distractions, poor design, and obscure naming conventions to increase difficulty.

What to Expect

  • Varied Difficulty: The challenges are structured progressively. The lower-numbered challenges are easier, while the difficulty increases as you proceed.
  • No Contract Modification: Participants are prohibited from modifying the provided contracts; the goal is to interact with them via Move scripts, client libraries, or command-line tools.
  • Explore Move in Depth: As you tackle these challenges, you'll get hands-on experience with Move’s key features, such as resource management, transaction scripts, and smart contract modules. Each challenge is designed to push you to think critically and apply Move concepts effectively.

Capturing Flags

Upon successfully completing a challenge, you will receive a "flag," which is a Move object generated as proof of completion. To validate your progress, there will be a submission window where you can enter the ID of the flag object. The system will verify whether the submitted flag is correct or not. Only valid flags will be counted toward your overall score in the CTF.

Setup

The CTF contract are already deployed on the IOTA Testnet. To get started, you need to install the IOTA CLI tool and connect to the Testnet. If you haven't done so already, follow these steps:

  1. Install the IOTA CLI Tool
  2. Connect to an IOTA Network
  3. Create and Address
  4. Fund Your Address
  5. Get the flags!

Challenge Addresses

ChallengeEntityAddress
challenge_1Package0xce9b1471301ffaf1453297cca008a68ce851b6a9ba9ab241c357c346177903f3
challenge_2Counter0x88c94654907f9daabbc25e9724997bd71a16e13f55cc4580f5e7c207e3ff28f2
Package0xb13a3cd66c6aa2ccff512fee9d950176acf0835fbf2091fa32e789d44baabe01
challenge_3CoinMetadata<0xf84628ac335e59ce6e305835cc09c0b9983d7b1695ab28e96cf875b49923e4ed::mintcoin::MINTCOIN>0x1bd5dfa2e5f1d3a3825403d92b8199ce3f69a5e70a785f28d698715b54d78321
Counter0xe7877309899ef0618ea0e269327f79e3bdf38ff2860fd01f5d278b46ea8cd630
TreasuryCap<0xf84628ac335e59ce6e305835cc09c0b9983d7b1695ab28e96cf875b49923e4ed::mintcoin::MINTCOIN>0xf3cb314954f0823961fdfe93ba9403314b4c53bb654f73ba37fe3c8400831e23
Package0xf84628ac335e59ce6e305835cc09c0b9983d7b1695ab28e96cf875b49923e4ed
challenge_4CoinMetadata<0x913ddcf84345bc087530e0b5d8b183780ecf902ea6cfa64b62d3f8a349ebafd9::airdrop::AIRDROP>0x163ef67f9631eea22ef33e58aab3e0d5c243184335e943047c28cb0a30985cf0
Vault0x4ae07fd00773080f9af2e43c2464667536d661ba0001a670e3971efbb01446e2
Package0x913ddcf84345bc087530e0b5d8b183780ecf902ea6cfa64b62d3f8a349ebafd9
TreasuryCap<0x913ddcf84345bc087530e0b5d8b183780ecf902ea6cfa64b62d3f8a349ebafd9::airdrop::AIRDROP>0xa9b65a0be78472f053298980a4fae935d12571731bfd7be3b9d41183a7f100ff
Counter0xc96bfaf42e3b8b1f2e5dbf469dc5f7846c911dbbb76966475cfd06cf3893b080
challenge_5Package0x84c3037c252e1b9142087a19c2bd776ee86316775484eb78e9f97618d877a577
challenge_6PizzaBoxRecycler0x16ddd3ae8cc4fe71f1acdc52838412a645eac93f1176450d05a77642f1816f34
Package0xcbe251b41a23a3952e64036f01367df82f1ccf3498cb139ff3ef44712441abc9
challenge_7Package0x202d65a2b1d2de4ba90e9eeb51ef4e16fafdaaa5c8b1dc3cbd8a935e5eb4d25c
challenge_8MintA<0x828a5da05496e86075fab366b2b66ec3ba0a3bfbed68ce56140d589d94da9b33::ctfa::CTFA>0x66e8dd865238a68f50db8be7177ee662b754133f409c35c36975f9d6e6f7f6e4
MintB<0x828a5da05496e86075fab366b2b66ec3ba0a3bfbed68ce56140d589d94da9b33::ctfb::CTFB>0x7c4f0f9d2e62bb0c440e5d281fbac69997dc14e1586cfedcea49f547a54eca1b
Package0x828a5da05496e86075fab366b2b66ec3ba0a3bfbed68ce56140d589d94da9b33
CoinMetadata<0x828a5da05496e86075fab366b2b66ec3ba0a3bfbed68ce56140d589d94da9b33::ctfa::CTFA>0x8f9c961398fcbfff8b9b1f14e1d6731bcfa2480f7c4f26fbb76496498bcc684e
CoinMetadata<0x828a5da05496e86075fab366b2b66ec3ba0a3bfbed68ce56140d589d94da9b33::ctfb::CTFB>0xca909dd26da43ac1d0992ebe796e0714d9382e0e4ec35640a1ac9845b3bb087d
--------------------------------------------------------------------------------
Package ID for Verifier: 0xdf6b7e52065dc5d4ae29fe212763226ba4e12eae81944d2ae6cf507296a767b1
CTFCap Object ID: 0xc9ee0b68715c3eb8130e25c2bddd67552e5787cc4271f2a75955aab4b0927b99
Shared Challenges Object ID: 0x44cabb21a9f66f8ce02c3c4881595bf439c2740c41341c7d257ee41e6238a4a0
--------------------------------------------------------------------------------