09.challenge

分析

1.全局观

四个合约

• deploy
  • 部署attack2合约
• attack2
  • 实现了IERC721Receiver，说明可以接收ERC721代币
  • 有选择性的调用EverytingIsArt合约的hopeIsInSight()
• attack
  • 实现了IERC721Receiver，说明可以接收ERC721代币
  • 有选择性的调用EverytingIsArt合约的hopeIsInSight()和theHope()
• EverytingIsArt
  • 是一个ERC721代币
  • 三个方法可以铸币
  • 初始化题目

2.任务

刚好获得288个NFT

function isCompleted() public view returns (bool) {
    require(balanceOf(msg.sender) == 288,"You are not yet a good artist, you should keep trying.");
    return true;
}

3.分析

有三个方法都可以获得代币，先来看becomeAnArtist()：

function becomeAnArtist(uint256 _count) public returns (bool) {
    require(_count >= 288, "Why don't you want to be an artist?");

    for (uint256 i = 0; i < _count; i++) {
        uint256 tokenId = totalMinted.add(1);
        _safeMint(msg.sender, tokenId);
        totalMinted = totalMinted.add(1);
    }

    return true;
}

额这个直接调用就完成题目了，因为题目是_safeMint()因此需要实现onERC721Received()，这个随便骗骗它就好

解题

// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.0;

import "forge-std/Test.sol";
import "../../src/09.challenge/EverytingIsArt.sol";

contract attackTest is Test {
    EverytingIsArt everytingIsArt;

    function setUp() public{
        everytingIsArt = new EverytingIsArt();
    }

    function test_isComplete() public{
        everytingIsArt.becomeAnArtist(288);
        assertEq(everytingIsArt.isCompleted(),true);
    }

    function onERC721Received(address operator, address from, uint256 tokenId, bytes calldata data)public returns (bytes4){
        return this.onERC721Received.selector;
    }
}