Your first hack, in 60 seconds
Every Daily Hack works the same way: read the briefing, look at the evidence, type the answer. Try it here first - no XP, no pressure.
Developers sometimes leave notes in a page's source code that visitors never see. This login page ships one. Read the source below and find the staff password.
<form action="/login" method="post">
<input name="user" placeholder="Username">
<input name="pass" type="password" placeholder="Password">
<!-- TODO: remove before launch - staff password is "sunrise" -->
<button>Sign in</button>
</form>
M2F14M3
Solved by
Who really called
Pembrook's on-chain vault lets only its owner withdraw, and the owner's key has never leaked. Yet the vault was drained after the owner used a new airdrop site that asked them to click Claim. The withdraw guard is doing what the author wrote; the author just asked the wrong question about who is calling. Read the contract and name the expression in the owner check that let a contract the owner merely interacted with spend on their behalf.
Play freely - sign up to submit your answer and earn XP.