// SPDX-License-Identifier: MIT
// Disclaimer: This is a capture-the-flag exercise. All ethereum tokens sent to this address will be taken out by other users. Do not use

pragma solidity =0.8.17;

contract VulnerableBank {
    struct User {
        address addr;
        uint256 amount;
    }

    User[] private users;

    function deposit() external payable {
        users.push(User({addr:msg.sender, amount: msg.value}));
    }

    function withdraw(uint256 index) external {
        User storage user = users[index];
        require(user.addr == msg.sender);
        uint256 amount = user.amount;

        user = users[users.length - 1];
        users.pop();

        msg.sender.call{value: amount}("");
    }
}