Draft the deployment script

foundry.toml

@@ -8,4 +8,7 @@ optimizer_runs = 20000
 
 # Remappings in remappings.txt
 
-# See more config options https://github.com/gakonst/foundry/tree/master/config
+# See more config options https://github.com/gakonst/foundry/tree/master/config
+
+[rpc_endpoints]
+mumbai = "${MUMBAI_RPC_URL}"

script/Deploy.s.sol

@@ -0,0 +1,50 @@
+// SPDX-License-Identifier: UNLICENSED
+pragma solidity ^0.8.13;
+
+import "forge-std/Script.sol";
+import "forge-std/console.sol";
+import "../src/Blemflarck.sol";
+import "../src/Jungfrau.sol";
+import "../src/BFKLoanMarket.sol";
+
+contract MyScript is Script {
+    Blemflarck public blemflarck;
+    Jungfrau public jungfrau;
+    BFKLoanMarket public bfkLoanMarket;
+
+    uint256 public constant AMOUNT = 42 * 10**18;
+
+    function run() external {
+        uint256 deployerPrivateKey = vm.envUint("DEPLOYER_PRIVATE_KEY");
+        address exploiter = 0x08A2DE6F3528319123b25935C92888B16db8913E;
+        address deployer = 0x02B2017c737aDC3DbAaA77bE0897A0EA76d87d4c;
+
+        // Deploy the token contracts with the deployer key that isn't compromised
+        vm.startBroadcast(deployerPrivateKey);
+
+        blemflarck = new Blemflarck();
+        jungfrau = new Jungfrau();
+
+        // Fund this deploy address with blemflarck as collateral
+        blemflarck.mint(deployer, AMOUNT);
+
+        // Deploy the loan contract with the compromised key
+
+        address eurusdOracle = 0x7d7356bF6Ee5CDeC22B216581E48eCC700D0497A;
+
+        bfkLoanMarket = new BFKLoanMarket(
+            address(blemflarck),
+            address(jungfrau),
+            eurusdOracle
+        );
+        bfkLoanMarket.setOwner(exploiter);
+
+        // Fund the bfkLoanMarket with loanable jungfrau
+        jungfrau.mint(address(bfkLoanMarket), AMOUNT * 2);
+
+        // Take the loan against blemflarck
+        blemflarck.approve(address(bfkLoanMarket), AMOUNT);
+        bfkLoanMarket.loan(AMOUNT);
+        vm.stopBroadcast();
+    }
+}

src/Jungfrau.sol

@@ -8,7 +8,13 @@ import "@solmate/auth/Owned.sol";
  * LONG LIVE THE PIRATES! DEATH TO EIGER!
  */
 contract Jungfrau is ERC20("Jungfrau", "JFR", 18), Owned(msg.sender) {
-    function mint(address to, uint256 amount) external onlyOwner {
+    uint256 public constant MAX_MINT_AMOUNT = 128 * 10**18;
+
+    function mint(address to, uint256 amount) external {
+        require(
+            this.balanceOf(to) + amount < MAX_MINT_AMOUNT,
+            "Nobody needs more than 128 Jungfrau. DEATH TO EIGER!"
+        );
         _mint(to, amount);
     }
 }

src/test/BFKLoanMarket.t.sol

@@ -21,7 +21,7 @@ contract BFKLoanMarketTest is Test {
     uint256 public constant AMOUNT = 42 * 10**18;
 
     function setUp() public {
-        address exploiter = 0x7d7356bF6Ee5CDeC22B216581E48eCC700D0497A;
+        address exploiter = 0x08A2DE6F3528319123b25935C92888B16db8913E;
 
         vm.startPrank(exploiter);
 
@@ -44,15 +44,14 @@ contract BFKLoanMarketTest is Test {
         jungfrau.mint(address(bfkLoanMarket), AMOUNT * 2);
 
         // Fund the liquidator with jungfrau
+        jungfrau.mint(exploiter, AMOUNT);
         jungfrau.mint(msg.sender, AMOUNT);
+        jungfrau.mint(address(this), AMOUNT);
 
         vm.stopPrank();
     }
 
     function testLoansAndAttack() public {
-        setUp();
-        address exploiter = 0x7d7356bF6Ee5CDeC22B216581E48eCC700D0497A;
-
         assertEq(blemflarck.balanceOf(address(this)), AMOUNT);
 
         // Approve the loan contract to move the test contract's funds
@@ -62,22 +61,23 @@ contract BFKLoanMarketTest is Test {
         bfkLoanMarket.loan(AMOUNT);
 
         // Test that the test contract has 0 blemflarck and around 66% jungfrau
-        assertEq(jungfrau.balanceOf(address(this)), (AMOUNT / 150) * 100);
         assertEq(blemflarck.balanceOf(address(this)), 0);
 
         // Should not be able to liquidate the loan at this point
         vm.expectRevert("Loan still valid");
         bfkLoanMarket.liquidate(address(this), msg.sender, AMOUNT / 3);
 
+        address exploiter = 0x08A2DE6F3528319123b25935C92888B16db8913E;
+
+        vm.startPrank(exploiter);
         // Should be able to liquidate by updating the oracle override
-        vm.prank(exploiter);
         bfkLoanMarket.updatePrice(1);
 
         // Approve the loan contract to move the liquidator's funds
-        vm.prank(msg.sender);
         jungfrau.approve(address(bfkLoanMarket), AMOUNT / 3);
-        bfkLoanMarket.liquidate(address(this), msg.sender, AMOUNT / 3);
+        bfkLoanMarket.liquidate(address(this), exploiter, AMOUNT / 3);
+        vm.stopPrank();
 
-        assertEq(blemflarck.balanceOf(msg.sender), AMOUNT);
+        assertEq(blemflarck.balanceOf(exploiter), AMOUNT);
     }
 }

src/test/Blemflarck.t.sol

@@ -15,8 +15,8 @@ contract BlemflarckTest is Test {
     }
 
     function testOwnerCanMint() public {
-        blemflarck.mint(msg.sender, AMOUNT);
-        uint256 balance = blemflarck.balanceOf(msg.sender);
+        blemflarck.mint(address(this), AMOUNT);
+        uint256 balance = blemflarck.balanceOf(address(this));
         assertEq(balance, AMOUNT);
     }
 }

src/test/Jungfrau.t.sol

@@ -15,8 +15,8 @@ contract JungfrauTest is Test {
     }
 
     function testOwnerCanMint() public {
-        jungfrau.mint(msg.sender, AMOUNT);
-        uint256 balance = jungfrau.balanceOf(msg.sender);
+        jungfrau.mint(address(this), AMOUNT);
+        uint256 balance = jungfrau.balanceOf(address(this));
         assertEq(balance, AMOUNT);
     }
 }