// the find
OpenZeppelin/ethernaut
Web3/Solidity based wargame
Ethernaut is OpenZeppelin's smart contract wargame — each level is a deployed Solidity contract with a specific vulnerability you have to exploit to pass. It's aimed at developers moving into smart contract security or auditing, not people learning Solidity syntax for the first time.
Levels are modeled on actual historical exploits (reentrancy, delegatecall storage collisions, ERC-777/DoubleEntryPoint style attacks) rather than invented CTF puzzles, so the patterns you learn map to real incidents. The whole stack is self-hostable — contracts, deploy scripts, and the React frontend are all in one repo, so you're not locked into the hosted instance. For an 8-year-old project it's still actively getting new levels (impersonator, magicanimalcarousel, stake) and new network configs (Sepolia, Arbitrum, Optimism, Amoy), which is rare for this kind of educational repo.
Local setup is clunky: specific Node version via nvm, yarn, Metamask with an imported ganache private key, and a manual edit to client/src/constants.js just to point at the right network — there's real friction before you can play a single level. Deploying new instances means hand-editing deploy.sepolia.json to add an "x" placeholder entry per level, which is a manual, error-prone step rather than a scripted one. The repo ships no in-repo solutions or write-ups, so if you get stuck you're pushed out to the OpenZeppelin forum — fine for the intended audience but a real wall for anyone less experienced. The frontend is also an older Redux/create-react-app-style setup (actions/index.js, containers/), which is dated compared to how most teams structure React apps now.