upgrade-and-call-hack

upgrade-and-call-hack.sol

function upgradeToAndCall(bytes4 function_selector, address varg1, uint256 varg2) public payable { 
    require(msg.data.length - 4 >= 64);
    require(varg2 <= uint64.max);
    require(4 + varg2 + 31 < msg.data.length);
    require(varg2.length <= uint64.max);
    require(4 + varg2 + varg2.length + 32 <= msg.data.length);
    v0 = v1 = bool(msg.sender);
    if (msg.sender) {
        v0 = msg.sender == _admin;
    }
    if (!v0) {
        v2 = v3 = tx.origin == msg.sender;
        if (v3) {
            v2 = v4 = bool(msg.sender);
        }
        if (v2) {
            v2 = msg.sender == owner_f364fa666b2e082663ca7dd04c16a2c736d1990df80fd97015fe242a48f33a00_0_19;
        }
        if (v2) {
            if (!(function_selector - bytes4(this << 96))) {
                v5 = v6 = 0x4d6(___function_selector__);
            }
        }
        v7 = v8 = stor_f364fa666b2e082663ca7dd04c16a2c736d1990df80fd97015fe242a48f33a07;
        if (v8 < 5) {
            v7 = 0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103;
        }
        if (!(v7 - 0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103)) {
            v9 = v10 = !_admin;
            if (_admin) {
                v9 = _admin != msg.sender;
            }
            require(v9, Error('TransparentUpgradeableProxy: admin cannot fallback to proxy target'));
        }
        v11 = v12 = uint8(_implementation >> 168);
        if (v12) {
            require(mapping_f364fa666b2e082663ca7dd04c16a2c736d1990df80fd97015fe242a48f33a02[function_selector] <= 2, Panic(33)); // failed convertion to enum type
            v11 = mapping_f364fa666b2e082663ca7dd04c16a2c736d1990df80fd97015fe242a48f33a02[function_selector] != 1;
        }
        require(v11);
        require(mapping_f364fa666b2e082663ca7dd04c16a2c736d1990df80fd97015fe242a48f33a02[function_selector] <= 2, Panic(33)); // failed convertion to enum type
        if (mapping_f364fa666b2e082663ca7dd04c16a2c736d1990df80fd97015fe242a48f33a02[function_selector] - 0) {
            require(mapping_f364fa666b2e082663ca7dd04c16a2c736d1990df80fd97015fe242a48f33a02[function_selector] <= 2, Panic(33)); // failed convertion to enum type
            if (!(mapping_f364fa666b2e082663ca7dd04c16a2c736d1990df80fd97015fe242a48f33a02[function_selector] - 2)) {
                require(mapping_f364fa666b2e082663ca7dd04c16a2c736d1990df80fd97015fe242a48f33a08[function_selector][msg.sender]);
            }
        } else {
            v13 = v14 = !mapping_f364fa666b2e082663ca7dd04c16a2c736d1990df80fd97015fe242a48f33a06[function_selector];
            if (mapping_f364fa666b2e082663ca7dd04c16a2c736d1990df80fd97015fe242a48f33a06[function_selector]) {
                v13 = msg.sender == mapping_f364fa666b2e082663ca7dd04c16a2c736d1990df80fd97015fe242a48f33a06[function_selector];
            }
            require(v13);
        }
        v15 = v16 = 0x3659cfe600000000000000000000000000000000000000000000000000000000 == function_selector;
        if (0x3659cfe600000000000000000000000000000000000000000000000000000000 != function_selector) {
            v15 = 0x4f1ef28600000000000000000000000000000000000000000000000000000000 == function_selector;
        }
        if (v15) {
            require(uint8(_implementation >> 160));
            require(0x15eb7373d0dcc708d4acbf6a8c61311cd4711347f7dc80d40782dc125ddc800 + ___function_selector__);
            STORAGE[___function_selector__] = address(_implementation) | bytes12(STORAGE[___function_selector__]);
        }
        v17 = 0x1fa7(function_selector);
        v18 = new bytes[](msg.data.length);
        CALLDATACOPY(v18.data, 0, msg.data.length);
        v18[msg.data.length] = 0;
        v5 = 0x1ca2(v18, v17);
        v19 = v20 = 0x3659cfe600000000000000000000000000000000000000000000000000000000 != function_selector;
        if (0x3659cfe600000000000000000000000000000000000000000000000000000000 != function_selector) {
            v19 = v21 = 0x4f1ef28600000000000000000000000000000000000000000000000000000000 != function_selector;
        }
        if (v19) {
            v19 = 0x8f28397000000000000000000000000000000000000000000000000000000000 != function_selector;
        }
        if (!v19) {
            if (address(STORAGE[___function_selector__]) != address(0xe343c368c483da30a84d845eb3d2a209fbf6a683)) {
                _implementation = bytes12(_implementation) | address(STORAGE[___function_selector__]);
                STORAGE[___function_selector__] = address(0xe343c368c483da30a84d845eb3d2a209fbf6a683) | bytes12(STORAGE[___function_selector__]);
                if (0x7050c9e0f4ca769c69bd3a8ef740bc37934f8e2c036e5a723fd8ee048ed3f8c3 != ___function_selector__) {
                    stor_7050c9e0f4ca769c69bd3a8ef740bc37934f8e2c036e5a723fd8ee048ed3f8c3_0_19 = address(_implementation);
                }
            }
            v22 = v23 = stor_f364fa666b2e082663ca7dd04c16a2c736d1990df80fd97015fe242a48f33a07;
            if (v23 < 5) {
                v22 = 0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103;
            }
            v24 = v25 = bool(address(STORAGE[v22]));
            if (address(STORAGE[v22])) {
                v24 = address(STORAGE[v22]) != address(0xd24f45ed65a520136b7ab1baf0866bdb6fb1ae81);
            }
            if (v24) {
                _admin = STORAGE[v22];
                STORAGE[v22] = bytes12(STORAGE[v22]) | address(0xd24f45ed65a520136b7ab1baf0866bdb6fb1ae81);
            }
        }
    } else {
        v26 = new bytes[](varg2.length);
        CALLDATACOPY(v26.data, varg2.data, varg2.length);
        v26[varg2.length] = 0;
        0x2243(1, v26, varg1);
    }
}