Ethernaut - 05 Token

// 漏洞合约（版本 ^0.6.0）
contract Token {
    mapping(address => uint) balances;
    uint256 public totalSupply;

    constructor(uint256 _initialSupply) public {
        balances[msg.sender] = totalSupply = _initialSupply;
    }

    function transfer(address _to, uint256 _value) public returns (bool) {
        // 这里使用了 unchecked！
        unchecked {
            balances[msg.sender] -= _value; // 若余额不足，会下溢到 2^256-1
            balances[_to] += _value;
        }
        return true;
    }
}