> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/web3pentesting/stage-2-remix-ide-lab-setup.md). # Stage 2: Remix IDE Lab Setup ### Table of Contents 1. What You're Setting Up and Why 2. Prerequisites 3. Part 1 - Remix IDE Basics 4. Part 2 - Deploying to the Remix VM (Safe Sandbox) 5. Part 3 - Installing MetaMask 6. Part 4 - Getting Testnet ETH 7. Part 5 - Deploying to a Real Testnet 8. Your First Starter Contract 9. What to Do Next 10. Troubleshooting Notes *** ### 1. What You're Setting Up and Why You need two separate environments, and you'll use both throughout this course: * **A fully simulated blockchain (Remix VM)** - runs entirely in your browser, resets whenever you refresh, comes pre-loaded with fake test accounts and fake ETH. This is where you'll do fast, safe, repeated experimentation, including intentionally breaking contracts to study attacks. * **A real public testnet (like Sepolia)** - an actual blockchain network, just one that isn't used for real money. This is closer to how production dapps actually behave, including real gas costs (using worthless test ETH), real transaction confirmation times, and real wallet interactions.
You'll mostly live in the Remix VM while learning vulnerability patterns, and move to a testnet when you want practice that feels closer to the real thing. *** ### 2. Prerequisites * A Chromium-based browser (Chrome, Brave, Edge) or Firefox - needed for the MetaMask extension later. * No Solidity knowledge required yet beyond what you've already covered in the fundamentals stage. * No installs needed for Remix itself, since it runs in the browser. *** ### 3. Part 1 - Remix IDE Basics Go to `remix.ethereum.org`. You'll see three main areas: * **File Explorer (left icon)** - where your `.sol` files live, organized into workspaces. * **Solidity Compiler (left icon)** - compiles your code and shows any errors. * **Deploy and Run Transactions (left icon)** - where you pick an environment, deploy contracts, and interact with them.
Create a new workspace if you don't already have one, then create a new file. Name it `SimpleBank.sol` - you'll use the starter contract below in it shortly.
*** ### 4. Part 2 - Deploying to the Remix VM (Safe Sandbox) 1. Paste your contract code into the file. 2. Go to the Solidity Compiler tab, make sure the compiler version matches your file's `pragma solidity` line, and click Compile. 3. Go to the Deploy and Run Transactions tab. 4. In the Environment dropdown, pick one of the Remix VM options. You'll notice a list of test accounts appear, each pre-loaded with a large amount of fake ETH. 5. Select your contract in the Contract dropdown and click Deploy. 6. Your deployed contract appears at the bottom under Deployed Contracts. Expand it to see its functions as clickable buttons - orange for state-changing functions, blue for read-only ones.
This environment resets every time you reload the page, which makes it perfect for repeatedly testing the same exploit pattern without any setup cost. **Refer** : *** ### 5. Part 3 - Installing MetaMask 1. Install the MetaMask extension from the official MetaMask website for your browser. 2. Create a new wallet. Write down the seed phrase it gives you, but treat this entire wallet as disposable - never put real funds into a wallet you created for learning/testing purposes.
1. Once set up, click the network selector at the top of MetaMask and enable "Show test networks" in settings if it isn't visible already. 2. Switch to the Sepolia test network. done till here :) *** ### 6. Part 4 - Getting Testnet ETH Testnet ETH has no real value, but you still need some to pay gas fees on a real testnet, since gas mechanics work the same way there as on the main network. 1. Copy your wallet address from MetaMask. 2. Search for a "Sepolia faucet" (several exist, run by different infrastructure providers) and paste your address in. 3. Wait a few moments and check MetaMask - you should see a small amount of test ETH appear. You generally only need a small amount, since testnet gas costs are trivial and you'll mostly be deploying small contracts. *** ### 7. Part 5 - Deploying to a Real Testnet 1. Back in Remix, go to the Deploy and Run Transactions tab. 2. In the Environment dropdown, select "Injected Provider - MetaMask" instead of a Remix VM option. 3. MetaMask will pop up asking you to confirm the connection between Remix and your wallet. Approve it. 4. Make sure MetaMask is set to Sepolia (or whichever testnet you funded). 5. Click Deploy as before. This time MetaMask will pop up again asking you to confirm the actual transaction, including the estimated gas fee. 6. Once confirmed, wait for the transaction to be mined - this takes real time (seconds to a couple of minutes), unlike the instant Remix VM. You now have a contract living on an actual public blockchain that anyone could theoretically look up on a block explorer. *** ### 8. Your First Starter Contract Below is a small, intentionally simple contract to deploy first, just to prove your whole pipeline works end to end. It's a basic bank: users can deposit ETH, check their balance, and withdraw it. It's written using the checks-effects-interactions pattern, which you covered in the attack topic sheet's reentrancy section, so it's actually written safely on purpose. See `SimpleBank.sol` in this same folder for the full contract. What to do with it: 1. Deploy it in the Remix VM. 2. Select a test account, enter a value in the "Value" field near the top of the Deploy panel (e.g. 1 ether), then call `deposit()`. 3. Call `getBalance()` to confirm your deposit was recorded. 4. Call `withdraw()` with an amount and confirm your balance decreases and the account receives ETH back. 5. Try calling `withdraw()` with more than your balance and confirm it correctly reverts. Once this feels natural, you'll later intentionally modify this same contract to reintroduce the reentrancy bug from the attack sheet, and write a small attacker contract to exploit it - that exercise fits into Stage 3. *** ### 9. What to Do Next * Get comfortable deploying and calling functions on both the Remix VM and Sepolia until it feels automatic. * Try writing a second, slightly different contract from scratch to build muscle memory with the compile-deploy-interact loop. * Once comfortable, move on to Stage 3, where you'll start deliberately breaking contracts using the vulnerability classes from the attack topic sheet. *** ### 10. Troubleshooting Notes * **Compiler errors mentioning pragma version** - make sure the compiler version selected in the Solidity Compiler tab matches the `pragma solidity` line at the top of your file. * **MetaMask not appearing as an environment option** - make sure the extension is installed and unlocked, and that you're on a page that isn't blocking extension popups. * **Deploy button doing nothing on a testnet** - check MetaMask for a pending confirmation popup, it sometimes appears behind the browser window. * **"Insufficient funds" on a testnet deploy** - you need testnet ETH in your wallet first; revisit the faucet step. * **Remix VM state disappearing** - this is expected behavior on page refresh, it's not a bug. Anything you want to keep needs to be redeployed, or you should move to a testnet where state persists. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://alham-rizvi.gitbook.io/alhamrizvi/web3pentesting/stage-2-remix-ide-lab-setup.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.