similar (or maybe exactly same) to this challenge:
https://ctftime.org/task/6881
except for the fact that we have to use fastbin dup instead of tcache dup, so there are a few more security checks and constraints.

Original writeup (https://github.com/pr0cf5/CTF-writeups/tree/master/2019/de1ctf/weapon).