The Fix

Now that you have known how the two hacks happened, it's time to fix things up. Create a safe version of the walletLibrary to beat this level!

A reference of the vulnerable library:

contract WalletLibrary {
    address public walletLibAddr;
    address payable public owner;
    address public initOwner;
    function initWallet(address payable _owner) external {
        owner = _owner;
    }
    function changeOwner(address payable _new_owner) external {
        require(msg.sender == owner, "You are not the owner");
        owner = _new_owner;
    }
    receive() external payable {}
    function withdraw(uint256 amount) external payable returns (bool) {
        require(msg.sender == owner, "You are not the owner");
        return owner.send(amount);
    }
    function getBalance() external view returns (uint256) {
        return address(this).balance;
    }
}

Deploy your safe version of the WalletLibrary and use the submitLibrary function to give it a try.