pragma solidity ^0.8.0;


import "forge-std/Test.sol";
import "@openzeppelin/contracts/token/ERC721/IERC721.sol";
import "@openzeppelin/contracts/token/ERC721/ERC721.sol";
import "@openzeppelin/contracts/access/Ownable.sol";


interface INFT is IERC721 {
    function mint(address to, uint256 tokenId) external;
}


contract NFTRefinanceMarket is Ownable {
    INFT public nft;
    mapping(uint256 => address) public tokenCreditors;


    constructor(INFT _nft) Ownable(msg.sender) {
        nft = _nft;
    }


    function refinance(uint256 _tokenId) external {
        // Check if this contract has approval to transfer the NFT
        require(nft.getApproved(_tokenId) == address(this), "Not approved");
        address originalOwner = nft.ownerOf(_tokenId);


        // Pull the NFT into this contract as collateral
        nft.transferFrom(originalOwner, address(this), _tokenId);


        // Record the caller as the creditor for this NFT
        tokenCreditors[_tokenId] = msg.sender;
    }
}

function testFrontRunRefinance() public {
        // 1. User approves the contract to refinance their NFT
        assertEq(nft.ownerOf(tokenId), user);
        vm.startPrank(user);
        nft.approve(address(nftRefinanceMarket), tokenId);
        assertEq(nft.getApproved(tokenId), address(nftRefinanceMarket));
        vm.stopPrank();


        // 2. Attacker monitors the mempool, and before the user calls refinance, the attacker calls refinance
        vm.startPrank(attacker);


        // Simulate the attacker front-running the transaction
        // In a real scenario, the attacker would increase the gas price to get their transaction included first
        nftRefinanceMarket.refinance(tokenId);


        // Verify that the attacker is now marked as the creditor for this NFT
        assertEq(nftRefinanceMarket.tokenCreditors(tokenId), attacker);


        // Verify that the NFT now belongs to the contract
        assertEq(nft.ownerOf(tokenId), address(nftRefinanceMarket));
        vm.stopPrank();


        // 3. User tries to refinance the NFT, but it has already been refinanced by the attacker
        vm.startPrank(user);
        vm.expectRevert("Not approved");
        nftRefinanceMarket.refinance(tokenId);
        vm.stopPrank();
    }

// Contract with a function that requires zero balance
contract Auction {
    IERC20 public token;
    event AuctionStarted(uint256 id);


    constructor(address _token) {
        token = IERC20(_token);
    }


    // Function that requires zero balance to execute
    function startAuction() external returns (uint256) {
        // Vulnerable check that can be exploited
        require(token.balanceOf(address(this)) == 0, "Balance must be zero");


        // Start auction logic would go here
        uint256 id = 1;
        emit AuctionStarted(id);
        return id;
    }
}

pragma solidity ^0.8.0;


import "forge-std/Test.sol";


/**
 * Overview:
 * Checklist Item ID: SOL-AM-FrA-4
 *
 * This test demonstrates a front-running vulnerability in a commit-reveal auction contract.
 * The vulnerability is that the protocol doesn't include the committer's address in the commitment,
 * allowing anyone to reveal another user's commitment and claim the reward.
 */


contract Auction {
    mapping(address => bytes32) public commitments;
    address public winner;
    uint256 public winningBid;
    bool public revealed;
    uint256 public endTime;


    constructor(uint256 _duration) {
        endTime = block.timestamp + _duration;
    }


    // Users commit their bids with a salt
    function commit(bytes32 commitment) public {
        require(block.timestamp < endTime, "Auction ended");
        commitments[msg.sender] = commitment;
    }


    // Vulnerable reveal function - doesn't include committer address in the commitment
    function reveal(uint256 bid, bytes32 salt) public {
        require(block.timestamp > endTime, "Reveal time not reached");
        require(!revealed, "Already revealed");


        // Vulnerability: commitment doesn't include the committer's address
        // This allows anyone to create the same commitment with the same bid and salt
        bytes32 expectedCommitment = keccak256(abi.encode(bid, salt));


        // The attacker can commit the same value and then reveal it
        require(commitments[msg.sender] == expectedCommitment, "Invalid commitment");


        // The revealer becomes the winner
        if (bid > winningBid) {
            winningBid = bid;
            winner = msg.sender;
        }
        revealed = true;
    }


    function claimReward() public view returns (address) {
        require(block.timestamp > endTime && revealed, "Auction not ended or not revealed");
        return winner;
    }
}

contract AuctionTest is Test {
    Auction public auction;
    address public bidder1;
    address public bidder2;
    uint256 public auctionDuration = 1 days;


    function setUp() public {
        bidder1 = address(1);
        bidder2 = address(2);
        auction = new Auction(auctionDuration);
        vm.warp(block.timestamp + 1 minutes);
    }


    function testFrontRunningReveal() public {
        uint256 bid1 = 1 ether;
        bytes32 salt1 = keccak256("secret1");


        // Both bidders create the same commitment with the same bid and salt
        // This is possible because the commitment doesn't include the committer's address
        bytes32 commitment = keccak256(abi.encode(bid1, salt1));


        // Bidder1 commits first
        vm.prank(bidder1);
        auction.commit(commitment);


        // Attacker sees the bid and salt values (e.g., from mempool or other side channel)
        // and commits the same values
        vm.prank(bidder2);
        auction.commit(commitment);


        vm.warp(block.timestamp + auctionDuration);


        // Attacker front-runs by revealing first
        vm.prank(bidder2);
        auction.reveal(bid1, salt1);


        // Attacker becomes the winner by front-running
        assertEq(auction.winner(), bidder2);
        assertEq(auction.winningBid(), bid1);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;


contract VulnerableVault {
    uint256 public delay = 60 minutes;
    mapping(address => uint256) public lastDeposit;
    mapping(address => uint256) public balances;


    function deposit(address _for) public payable {
        lastDeposit[_for] = block.timestamp;
        balances[_for] += msg.value;
    }


    function withdraw(uint256 _amount) public {
        require(block.timestamp >= lastDeposit[msg.sender] + delay,
            "Wait period not over");
        require(balances[msg.sender] >= _amount, "Insufficient funds");
        balances[msg.sender] -= _amount;
        (bool success,) = payable(msg.sender).call{value: _amount}("");
        require(success, "Transfer failed");
    }
}

// Corrected deposit function (inside VulnerableVault)
function deposit() public payable {
    // Only affects the caller's state
    lastDeposit[msg.sender] = block.timestamp;
    balances[msg.sender] += msg.value;
}

// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.17;


// Target contract with a function that consumes some gas
contract Target {
    uint256 private _storedData = 0;
    function execute(bytes memory _data) external {
        // Simulate some work that consumes gas
        uint256 i;
        while(i < 100) {
            i++;
            _storedData += i;
        }
    }
}


// Relayer contract vulnerable to insufficient gas griefing
contract Relayer {
    mapping (bytes => bool) public executed; // Replay protection mapping
    address public target;


    constructor(address _target) {
        target = _target;
    }


    function forward(bytes memory _data) public {
        // Check replay protection
        require(!executed[_data], "Replay protection");
        executed[_data] = true;


        // Vulnerability: External call is made, but its success status is NOT checked.
        // If target.call runs out of gas (due to limited gas sent by attacker),
        // this function DOES NOT revert. The state change above persists.
        target.call(abi.encodeWithSignature("execute(bytes)", _data));
    }
}

// Исправленный фрагмент функции forward (внутри Relayer)

function forward(bytes memory _data) public {
    require(!executed[_data], "Защита от повторного выполнения");
    executed[_data] = true; 

// Взаимодействие: выполнение внешнего вызова

(bool success, ) = target.call(abi.encodeWithSignature("execute(bytes)", _data));
require(success, "Внешний вызов завершился неудачно");

} 

pragma solidity ^0.8.0;


// SPDX-License-Identifier: UNLICENSED
contract Auction {
    uint public auctionEndTime;
    address public highestBidder;
    uint public highestBid;
    mapping(address => uint) public pendingReturns;
    bool public ended;


    event BidPlaced(address bidder, uint amount);
    event AuctionEnded(address winner, uint amount);


    constructor(uint _duration) {
        auctionEndTime = block.timestamp + _duration; // Vulnerability!
    }


    function isAuctionEnded() public view returns (bool) {
        return block.timestamp >= auctionEndTime; // Vulnerable comparison!
    }


    function bid() public payable {
        require(!isAuctionEnded(), "Auction has ended");
        require(msg.value > highestBid, "Bid not high enough");


        if (highestBid > 0) {
            pendingReturns[highestBidder] += highestBid;
        }


        highestBidder = msg.sender;
        highestBid = msg.value;
        emit BidPlaced(msg.sender, msg.value);
    }


    function endAuction() public {
        require(!ended, "Auction already ended");
        require(isAuctionEnded(), "Auction not yet ended");


        ended = true;
        emit AuctionEnded(highestBidder, highestBid);
    }


    function withdraw() public returns (bool) {
        uint amount = pendingReturns[msg.sender];
        if (amount > 0) {
            pendingReturns[msg.sender] = 0;


            // Use call instead of transfer for better compatibility
            (bool success, ) = payable(msg.sender).call{value: amount}("");
            require(success, "Transfer failed");
        }
        return true;
    }
}

pragma solidity ^0.8.0;


contract FixedAuction {
    uint256 public auctionEndBlock;
    uint256 public blockDuration;


    constructor(uint256 _blockDuration) {
        auctionEndBlock = block.number + _blockDuration;
        blockDuration = _blockDuration; // Duration of auction in blocks
    }


    function finalizeAuction() public {
        require(block.number >= auctionEndBlock, "Auction is not yet over.");
        // Distribute funds
    }
}

pragma solidity ^0.8.0;


// SPDX-License-Identifier: UNLICENSED


contract Lottery {
    address public winner;


    function pickWinner() public {
        // Vulnerable randomness generation using block.timestamp
        uint256 randomNumber = uint256(block.timestamp) % 100;
        if (randomNumber == 7) {
            winner = msg.sender;
        } else {
            winner = address(0);
        }
    }


    function getBlockTimestamp() public view returns (uint256) {
        return block.timestamp;
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.19;


import {VRFConsumerBaseV2Plus} from "@chainlink/contracts/src/v0.8/vrf/dev/VRFConsumerBaseV2Plus.sol";
import {VRFV2PlusClient} from "@chainlink/contracts/src/v0.8/vrf/dev/libraries/VRFV2PlusClient.sol";


/**
 * @noscript SecureLottery
 * @notice A lottery contract using Chainlink VRF V2.5 for verifiable randomness
 * @dev This is an example contract and should not be used in production without proper auditing
 */
contract SecureLottery is VRFConsumerBaseV2Plus {
    // Chainlink VRF configuration
    uint256 public s_subnoscriptionId;
    bytes32 public keyHash = 0x787d74caea10b2b357790d5b5247c2f63d1d91572a9846f780606e4d953677ae; // Sepolia gas lane
    uint32 public callbackGasLimit = 100000;
    uint16 public requestConfirmations = 3;
    uint32 public numWords = 1;


    // Lottery state variables
    uint256 public randomNumber;
    address public winner;
    mapping(uint256 => bool) public requestIds;
    uint256 public lastRequestId;


    // Events
    event RandomnessRequested(uint256 requestId);
    event WinnerSelected(address winner, uint256 randomNumber);


    /**
     * @param subnoscriptionId Chainlink VRF subnoscription ID
     * @param vrfCoordinator Address of the VRF Coordinator contract
     */
    constructor(
        uint256 subnoscriptionId,
        address vrfCoordinator
    ) VRFConsumerBaseV2Plus(vrfCoordinator) {
        s_subnoscriptionId = subnoscriptionId;
    }


    /**
     * @notice Request random number from Chainlink VRF
     * @param useNativePayment Whether to pay in native tokens (true) or LINK (false)
     * @return requestId The ID of the randomness request
     */
    function requestRandomWinner(bool useNativePayment) external returns (uint256 requestId) {
        // Request randomness from Chainlink VRF
        requestId = s_vrfCoordinator.requestRandomWords(
            VRFV2PlusClient.RandomWordsRequest({
                keyHash: keyHash,
                subId: s_subnoscriptionId,
                requestConfirmations: requestConfirmations,
                callbackGasLimit: callbackGasLimit,
                numWords: numWords,
                extraArgs: VRFV2PlusClient._argsToBytes(
                    VRFV2PlusClient.ExtraArgsV1({
                        nativePayment: useNativePayment
                    })
                )
            })
        );


        requestIds[requestId] = true;
        lastRequestId = requestId;
        emit RandomnessRequested(requestId);
        return requestId;
    }


    /**
     * @notice Callback function called by VRF Coordinator when randomness is fulfilled
     * @param requestId The ID of the randomness request
     * @param randomWords The random words generated by Chainlink VRF
     */
    function fulfillRandomWords(
        uint256 requestId,
        uint256[] calldata randomWords
    ) internal override {
        require(requestIds[requestId], "Request not found");
        require(randomWords.length > 0, "Random words array is empty");


        // Process the random value
        randomNumber = randomWords[0] % 100; // Example: limit to 0-99 range


        // Lottery winner selection logic would go here
        // For example, if you have participants in an array:
        // winner = participants[randomNumber % participants.length];


        emit WinnerSelected(winner, randomNumber);
    }


    /**
     * @notice Get the status of a VRF request
     * @param requestId The ID of the randomness request
     * @return exists Whether the request exists
     */
    function getRequestStatus(uint256 requestId) external view returns (bool exists) {
        return requestIds[requestId];
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.13;


import "@openzeppelin/contracts/token/ERC20/ERC20.sol";


// Simple ERC20 token for testing
contract TestToken is ERC20 {
    constructor(string memory name, string memory symbol, uint256 initialSupply) ERC20(name, symbol) {
        _mint(msg.sender, initialSupply);
    }
}


// Simplified DEX that's vulnerable to front-running
contract VulnerableDEX {
    TestToken public tokenA;
    TestToken public tokenB;
    uint public reserveA;
    uint public reserveB;


    constructor(address _tokenA, address _tokenB) {
        tokenA = TestToken(_tokenA);
        tokenB = TestToken(_tokenB);
    }


    // Initialize liquidity
    function addLiquidity(uint amountA, uint amountB) external {
        tokenA.transferFrom(msg.sender, address(this), amountA);
        tokenB.transferFrom(msg.sender, address(this), amountB);
        reserveA += amountA;
        reserveB += amountB;
    }


    // Calculate output amount for a given input
    function _calculateSwapOutput(address tokenIn, uint amountIn) internal view returns (uint amountOut) {
        require(tokenIn == address(tokenA) || tokenIn == address(tokenB), "Invalid token");


        bool isTokenA = tokenIn == address(tokenA);


        if (isTokenA) {
            amountOut = (reserveB * amountIn) / (reserveA + amountIn);
            require(amountOut < reserveB, "Insufficient liquidity");
        } else {
            amountOut = (reserveA * amountIn) / (reserveB + amountIn);
            require(amountOut < reserveA, "Insufficient liquidity");
        }


        return amountOut;
    }


    // Execute the swap with pre-calculated output
    function _executeSwap(address tokenIn, uint amountIn, uint amountOut, address sender) internal {
        bool isTokenA = tokenIn == address(tokenA);


        if (isTokenA) {
            tokenA.transferFrom(sender, address(this), amountIn);


            // Update reserves
            reserveA += amountIn;
            reserveB -= amountOut;


            // Transfer output tokens to the user
            tokenB.transfer(sender, amountOut);
        } else {
            tokenB.transferFrom(sender, address(this), amountIn);


            reserveB += amountIn;
            reserveA -= amountOut;


            tokenA.transfer(sender, amountOut);
        }
    }


    // Vulnerable swap function (no minimum output)
    function swap(address tokenIn, uint amountIn) external returns (uint amountOut) {
        // Calculate the expected output
        amountOut = _calculateSwapOutput(tokenIn, amountIn);


        // Execute the swap
        _executeSwap(tokenIn, amountIn, amountOut, msg.sender);


        return amountOut;
    }
}

// Secure swap function with minimum output requirement
    function swapWithMinimumOutput(
        address tokenIn,
        uint amountIn,
        uint minAmountOut
    ) external returns (uint amountOut) {
        // Calculate the expected output
        amountOut = _calculateSwapOutput(tokenIn, amountIn);


        // Check slippage before executing the swap
        require(amountOut >= minAmountOut, "Slippage too high");


        // Execute the swap
        _executeSwap(tokenIn, amountIn, amountOut, msg.sender);


        return amountOut;
    }