> For the complete documentation index, see [llms.txt](https://ret2basic.gitbook.io/ctfwriteup/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ret2basic.gitbook.io/ctfwriteup/web3-ctf/quillctf/temporary-variable.md).

# Temporary Variable

## Idea

This is a no-brainer one. Basically there are two functions called `supply()` and `remove()`:

```solidity
    function supply(
        address _user,
        uint256 _amount
    ) public {
        require(_user == msg.sender, "unauthorized");
        require(_balances[_user] == 0, "already exists");
        require(_amount > 0, "invalid amount");
        _balances[_user] += _amount;
        _blacklist[_user] = false;
    }
```

```solidity
    function remove (
        address _from,
        uint256 _amount
    ) public isUserBlacklisted(_from)  {
        require(_from == msg.sender, "unauthorized");
        uint256 _accountbalance = _balances[_from];
        require(_amount <= _accountbalance, "not enough balance");


        if (_amount == _accountbalance) {
            delete _balances[_from];
            delete _blacklist[_from];
        }
        else {
            _accountbalance -= _amount;
            _balances[_from] = _accountbalance;
        }
    }
```

The assertion is:

```solidity
        uint256 newbalance = _factory.checkbalance(user1);
        assertEq(newbalance, 200);
```

where `checkbalance()` just reads the mapping `_balance`:

```solidity
    function checkbalance(address _user) public view returns (uint256) {
        return _balances[_user];
    }
```

This is so obvious. The function `supply()` does not ask for money, we can just call it with any amount we desire. Before calling `supply()`, we should call `remove()` to clear user balance, so that the check `require(_balances[_user] == 0, "already exists");` will pass.

## PoC

{% embed url="<https://github.com/ret2basic/QuillCTF-PoC/blob/main/TemporaryVariable/test/factory.t.sol>" %}
TemporaryVariable PoC
{% endembed %}