1
contract BifrostBridgeVulnerable {
2
    address[] public asgardians;
3
    mapping(address => uint256) public vaultOfAsgard;
4

5
    function enterBifrost(address realmWalker) external payable {
6
        require(msg.value > 0, "Bifrost requires Ether toll");
7
        if (vaultOfAsgard[realmWalker] == 0) {
8
            asgardians.push(realmWalker);
9
        }
10
        vaultOfAsgard[realmWalker] += msg.value;
11
    }
12

13
    // ⚠️ The dangerous loop
14
    function openBifrost() external {
15
        for (uint256 i = 0; i < asgardians.length; i++) {
16
            address traveler = asgardians[i];
17
            uint256 tribute = vaultOfAsgard[traveler];
18
            if (tribute > 0) {
19
                // Loki reverts here → entire tx fails
20
                (bool sent, ) = payable(traveler).call{value: tribute}("");
21
                require(sent, "Bifrost jammed!");
22
                vaultOfAsgard[traveler] = 0;
23
            }
24
        }
25
    }
26
}

1
contract LokiTrickster {
2
    receive() external payable {
3
        revert("Loki jams the Bifrost!");
4
    }
5
}

1
contract BifrostBridge_Safe {
2
    mapping(address => uint256) public vaultOfAsgard;
3

4
    function enterBifrost() external payable {
5
        require(msg.value > 0, "Bifrost requires Ether toll");
6
        vaultOfAsgard[msg.sender] += msg.value;
7
    }
8

9
    function crossBifrostSafe() external {
10
        uint256 tribute = vaultOfAsgard[msg.sender];
11
        require(tribute > 0, "No tribute to cross");
12

13
        vaultOfAsgard[msg.sender] = 0; // optimistic clear
14

15
        (bool sent, ) = payable(msg.sender).call{value: tribute}("");
16
        if (!sent) {
17
            // restore so user can retry later
18
            vaultOfAsgard[msg.sender] = tribute;
19
        }
20
    }
21
}

1
contract DoSBifrostTest is Test {
2
    BifrostBridgeVulnerable bifrostVuln;
3
    BifrostBridgeFixed bifrostSafe;
4
    LokiTrickster loki;
5
    address thor = makeAddr("Thor");
6

7
    function setUp() public {
8
        // Deploy contracts
9
        bifrostVuln = new BifrostBridgeVulnerable();
10
        bifrostSafe = new BifrostBridgeFixed();
11
        loki = new LokiTrickster();
12

13
        // Fund users
14
        vm.deal(thor, 1 ether);
15
        vm.deal(address(loki), 1 ether);
16

17
        // Deposit into vulnerable contract
18
        bifrostVuln.enterBifrost{value: 1 ether}(thor);
19
        bifrostVuln.enterBifrost{value: 1 ether}(address(loki));
20
    }
21

22
    function test_BifrostJammedByLoki() public {
23
        // Expect revert because Loki reverts in openBifrost
24
        vm.expectRevert();
25
        bifrostVuln.openBifrost();
26
    }
27

28
    function test_ThorCrossesSafeBifrost() public {
29
        vm.prank(thor);
30
        bifrostSafe.enterBifrost{value: 1 ether}();
31

32
        uint256 beforeBalance = thor.balance;
33
        uint256 beforeVault = bifrostSafe.vaultOfAsgard(thor);
34

35
        vm.prank(thor);
36
        bifrostSafe.crossBifrostSafe();
37

38
        // Assert Thor received funds
39
        assertEq(address(thor).balance, beforeBalance + beforeVault);
40
        // Assert vault cleared
41
        assertEq(bifrostSafe.vaultOfAsgard(thor), 0);
42
    }
43

44
    function test_LokiCannotBlockThor() public {
45
        // Loki enters safe contract
46
        vm.prank(address(loki));
47
        bifrostSafe.enterBifrost{value: 1 ether}();
48

49
        // Loki tries to withdraw but reverts internally (simulated in crossBifrostSafe)
50
        vm.prank(address(loki));
51
        bifrostSafe.crossBifrostSafe();
52

53
        // Thor enters and withdraws safely
54
        vm.prank(thor);
55
        bifrostSafe.enterBifrost{value: 1 ether}();
56

57
        vm.prank(thor);
58
        bifrostSafe.crossBifrostSafe();
59

60
        // Assert Thor successfully received funds
61
        assertEq(address(thor).balance, 1 ether);
62
        assertEq(bifrostSafe.vaultOfAsgard(thor), 0);
63
    }
64
}