Immunefi_ch2.sol

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.18;

import "forge-std/Test.sol";
import "@openzeppelin/contracts/utils/Address.sol";
import "@openzeppelin/contracts/utils/StorageSlot.sol";
import "@openzeppelin/contracts/access/Ownable.sol";
import "@openzeppelin/contracts/proxy/utils/Initializable.sol";

//#SpotTheBugChallenge
//https://twitter.com/immunefi/status/1562858386244665348?s=21&t=d7_HtNra5AGuNmzVtv9uKg
interface imp {
    function initialize(address) external;
}

contract ContractTest is Test {
    Proxy ProxyContract;
    Implementation ImplementationContract;

    function testChallenge() public {
        ImplementationContract = new Implementation();
        console.log(
            "ImplementationContract addr",
            address(ImplementationContract)
        );
        ProxyContract = new Proxy(address(ImplementationContract));

        emit log_named_bytes32(
            "Storage slot 0:",
            vm.load(address(ProxyContract), bytes32(uint256(0)))
        );
    }
}

contract Proxy {
    //bytes32 constant internal _IMPLEMENTATION_SLOT = keccak256("where.bug.ser");  //correct pattern.
    bytes32 internal _IMPLEMENTATION_SLOT = keccak256("where.bug.ser"); // wrong

    constructor(address implementation) {
        _setImplementation(address(0));
        Address.functionDelegateCall(
            implementation,
            abi.encodeWithSignature("initialize(address)", msg.sender)
        );
    }

    fallback() external payable {
        address implementation = _getImplementation();
        Address.functionDelegateCall(implementation, msg.data);
    }

    function _setImplementation(address newImplementation) private {
        //require(Address.isContract(newImplementation), "ERC1967: new implementation is not a contract");
        StorageSlot
            .getAddressSlot(_IMPLEMENTATION_SLOT)
            .value = newImplementation;
    }

    function _getImplementation() public view returns (address) {
        return StorageSlot.getAddressSlot(_IMPLEMENTATION_SLOT).value;
    }
}

contract Implementation is Ownable, Initializable {
    // function initialize(address owner) external {    //test purpose
    function initialize(address owner) external initializer {
        _transferOwnership(owner);
    }
}