Open-World — sekai2026

Description

Jump into the TON =ω=

English summary: the task deploys a TON/Tolk Challenge contract with a JettonMinter and JettonWallet pair. The goal is to make isSolved() return true for the target session UUID and then request the flag from the nc service.

Analysis

The solve condition is checked when Challenge receives TransferNotificationForRecipient from its own target jetton wallet. The notification must contain:

• forwardPayload = Solve (0x13370005),
• transferInitiator == storage.player,
• jettonAmount >= 100.

So the target player must own at least 100 target jettons and transfer them to the target Challenge with a non-zero forwarded TON amount and the Solve payload.

Inside one session this is impossible with the initial funds:

• The player starts with about 1 TON.
• PlayerBonus appears to allow two bonuses of 50 jettons, but Tolk lazy evaluation makes hasBonus = storage.remainingPlayerBonus != 0 evaluate after storage.remainingPlayerBonus -= 1. With remainingPlayerBonus = 2, only the first call mints 50 jettons; the second decrements to zero and mints nothing.
• Buy(amount) requires msg.value > amount * 2 TON + 0.12, so buying the missing 50 costs about 100.12 TON.
• Selling the free 50 jettons returns about 100 TON, but consumes those target jettons, leaving the same session capped at 50 useful target jettons.

The key observation was the challenge title: Open-World. The new command creates a new player and challenge session, but all sessions on the same launched host live on the same underlying TON localchain. That means TON obtained in one session can be transferred to the player wallet of another session.

Solution

Use two sessions on the same host: a target session that will be solved, and a donor session used only as a source of TON.

...