3 level ether transfer

Question

contract foster{
    vulnerable v = new vulnerable();
    attacker a = new attacker(address(v));

     constructor() public payable{

        //  a.deposit(address(v));     // transferring 3 ethers to vulnerable contract and rest to the attacker contract
        //  v.addNominee(address(a));
     }

     function action() public payable{
         a.deposit(address(v));     // transferring 3 ethers to vulnerable contract and rest to the attacker contract
         v.addNominee(address(a));
     }

     function getTargetBalance() public view returns(uint256, uint256){
        return (address(v).balance , address(this).balance);
    }

     function attack() public payable{
         v.transact();
     }
}

Here is what I wanna do. I have two contracts namely attacker and vulnerable with the following definitions.

contract attacker

contract attacker{ 

    constructor(address payable _vulnerableContract) public{
        vulnerable v = vulnerable(_vulnerableContract);
    }

    function deposit(address payable _addr) payable public{
        _addr.transfer(msg.value);
    }

    function() external payable{
       }

}

contract vulnerable

contract vulnerable{

    mapping (address => uint256) balance;
    uint256 _amount;

    function() external payable{
    }

    function deposit() payable public{
        address(this).transfer(_amount);
    }
}

---

Here in the foster contract, I want to create one instance each of vulnerable and attacker.

I want to make the function action in the foster contract to call a.deposit(address(v)), and transfer the ethers from a's behalf to contract v. So that the net ether is transferred from calling account to contract instance v.

Then I want to add a as a nominee to the v instance.

When I am doing the thing I have done in the contract, the ether would go to contract foster and not to v. How can I make it happen?

My final aim is to trigger a failed send() bug when I call, v.transact, for that I need some ethers with the contract v. I'll add some failure in the function() payable of the contract a later.

Answer 1

Solution found. Thanks if someone was trying to do it.

The thing we need to do here is, after calling a.deposit() here in the foster contract

we need to transfer the ethers to v. I've added the following in the action() function. It does the required thing.

a.deposit(address(v));  
address(v).send(msg.value);

The problem was that the ethers were first transferred to the contract foster, so we need to transfer it to the contract v after this. It solves the problem of 3 level ether transfer.

---

The complete solution lies here in the following gist link : https://gist.github.com/johnsoncarl/99d761df62da338a41ce3a3d6b162698