friend_tech 第一笔交易只能买 1 个key?

1
2
3
4
5
6
7
8
9
10
11
12
13
14

function buyShares(address sharesSubject, uint256 amount) public payable {
    uint256 supply = sharesSupply[sharesSubject];
    require(supply > 0 || sharesSubject == msg.sender, "Only the shares' subject can buy the first share");
    uint256 price = getPrice(supply, amount);
    uint256 protocolFee = price * protocolFeePercent / 1 ether;
    uint256 subjectFee = price * subjectFeePercent / 1 ether;
    require(msg.value >= price + protocolFee + subjectFee, "Insufficient payment");
    sharesBalance[sharesSubject][msg.sender] = sharesBalance[sharesSubject][msg.sender] + amount;
    sharesSupply[sharesSubject] = supply + amount;
    emit Trade(msg.sender, sharesSubject, true, amount, price, protocolFee, subjectFee, supply + amount);
    (bool success1,) = protocolFeeDestination.call{value: protocolFee}("");
    (bool success2,) = sharesSubject.call{value: subjectFee}("");
    require(success1 && success2, "Unable to send funds");
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

import {TestHarness} from "../../TestHarness.sol";

interface iFriendtech {
    function buyShares(address sharesSubject, uint256 amount) external payable;
}

contract fuck_friend_tech is TestHarness {
    iFriendtech friendtech = iFriendtech(0xCF205808Ed36593aa40a44F10c7f7C2F67d4A4d4);

    function setUp() external {
        cheat.createSelectFork("base", 4_119_770);
        cheat.deal(address(this), 100 ether);
    }

    function test_attack() external {
        friendtech.buyShares{value: 100 ether}(address(this), 2);
    }

    receive() external payable {}
}

1
2
3
4
5
6
7
8
9

function getPrice(uint256 supply, uint256 amount) public view returns (uint256) {
    uint256 sum1 = supply == 0 ? 0 : (supply - 1) * (supply) * (2 * (supply - 1) + 1) / 6;
    uint256 sum2 = supply == 0 && amount == 1
        ? 0
        : (supply - 1 + amount) * (supply + amount) * (2 * (supply - 1 + amount) + 1) / 6;

    uint256 summation = sum2 - sum1;
    return summation * 1 ether / 16_000;
}