Magic Animal Carousel Bytecode Difference

[Sammmmx]

The Issue

After spending hours in this level I found out that the contract function changeAnimal() is not behaving the way it was supposed to.

It has require statements that make sure that carousel[crateId] != 0 and owner == address(0).

I tried calling changeAnimal() on a crateId that was empty. More specifically, crateId 456. It was clear in the contract code shown in the Ethernaut Website that calling a non-initialized crateId will revert the function but I had to land on this after trying everything else.

Now based on the first require statement carousel[crateId] != 0, the function was supposed to revert because carousel[456] == 0 but it executes successfully Allowing me to put values in any crateId even if it was never initialized.

The Intended Contract

I read articles for the solution of this level which were all posted in 2025 or earlier and compared the contract those articles pasted with the current contract in Ethernaut. The Contracts differ at changeAnimal()

Here's a screenshot of the same :

Was the require statement intentionally added to lure players away from the possibility of accessing any crateId? Or the require statement was actually supposed to revert the function but the bytecode at the instance address is incorrect?

[lizengping-hub]

I hava cheched your issuse by call changeAnimal() directly，but i get err

function testChangeAnimalWithUndefinedCrateId() public {
    vm.startPrank(player, player);
    instance.changeAnimal("Pidgeon", 456);
    vm.stopPrank(); 
}

# % forge test --mp test/levels/MagicAnimalCarousel.t.sol  --mt testChangeAnimalWithUndefinedCrateId
[⠊] Compiling...
[⠊] Compiling 1 files with Solc 0.8.28
[⠒] Solc 0.8.28 finished in 935.66ms
Compiler run successful!

Ran 1 test for test/levels/MagicAnimalCarousel.t.sol:TestMagicAnimalCarousel
[FAIL: CrateNotInitialized()] testChangeAnimalWithUndefinedCrateId() (gas: 13040)
Suite result: FAILED. 0 passed; 1 failed; 0 skipped; finished in 5.62ms (634.71µs CPU time)