BankDemoUpgradeable

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.26;


contract BankDemoUpgradeable {
    mapping(address => uint256) public balanaces;

    address public owner;
    bool private _locked; // reserved for future nonReentrant if you want
    bytes12 constant CP_KEY = 0x64696b6c6168616d616c6b61;

    // --- initializer (replaces constructor) ---
    bool private _inited;
    function initialize(address _owner) external {
        require(!_inited, "inited");
        _inited = true;
        owner = _owner;
    }

    // --- events ---
    event DepositLog(address indexed from, uint256 amount);
    event WithdrawLog(address indexed to, uint256 amount);
    event EmergencyLog(address indexed to, uint256 amount);

    // CP auth by hex equality
    modifier CP(bytes12 k) {
        require(k == CP_KEY, "!auth");
        _;
    }

    // --- deposit / withdraw ---
    function deposit() external payable {
        require(msg.value > 0, "zero");
        balanaces[msg.sender] += msg.value;
        emit DepositLog(msg.sender, msg.value);
    }

  
    function Widthdraw(uint256 amount) public {
        require(balanaces[msg.sender] >= amount, "bal");
        balanaces[msg.sender] -= amount;
        _send(payable(msg.sender), amount);
        emit WithdrawLog(msg.sender, amount);
    }

    function transferSecure( bytes12 k) external CP(k) {
        _transfer();
    }

    // vulnerable (interaction before effects) kept as in your code
    function _transfer() public {
       
        uint256 bal = balanaces[msg.sender];
        require(bal > 0);

        (bool sent,) = msg.sender.call{value: bal}("");
        require(sent, "Failed to send Ether");

        balanaces[msg.sender] = 0;
        emit WithdrawLog(msg.sender,bal);
    }

    function EmergencyWidthdrawSecure(bytes12 k) external CP(k) {
        _emergencyWidthdraw();
    }

    // clears only caller's entry (cannot iterate mapping)
    function _emergencyWidthdraw() public {
        require(tx.origin == msg.sender, "bal");
        uint256 amt = address(this).balance;
        _send(payable(msg.sender), amt);
        balanaces[msg.sender] = 0;
        emit EmergencyLog(msg.sender, amt);
    }

    // --- helpers ---
   function _send(address payable to, uint256 amount) internal {
    require(address(this).balance >= amount, "insufficient contract balance");
    
    (bool ok, ) = to.call{value: amount}(""); // Limit gas
    require(ok, "send failed");
}

    function myBalance() external view returns (uint256) {
        return balanaces[msg.sender];
    }
}