Check the value of flip before using the same calcul as in the function and send the right value.
The exploit use tx.origin, create another contract to call the addPoint() function.
Very simple underflow exploit
As transfer() it rely on tx.origin so another contract need to be created. But it needs to use the same interface as the Building interface in HackMeIfYouCan.sol Another thing is that isLastFloor() function should not return twice the same value.
The exploit rely on the fact that all data are visible on chain. Just get the data[12] value on chain and cast to bytes16 to start the function. To get the value use bytes32(uint256(16)). 16 is the index of the data[12] value.
Same exploit as before
Call contribute first to get the right value for the callBack function. Then call receive() with the right value.