diff --git a/onchain/script/backtesting/AttackRunner.s.sol b/onchain/script/backtesting/AttackRunner.s.sol
index deb1867..a7fced0 100644
--- a/onchain/script/backtesting/AttackRunner.s.sol
+++ b/onchain/script/backtesting/AttackRunner.s.sol
@@ -153,7 +153,7 @@ contract AttackRunner is Script {
     address internal constant WETH = 0x4200000000000000000000000000000000000006;
     address internal constant DEFAULT_SWAP_ROUTER = 0x2626664c2603336E57B271c5C0b26F421741e481;
     address internal constant DEFAULT_NPM_ADDR = 0x03a520B32c04bf3beef7BEb72E919cF822Ed34F3;
-    address internal constant V3_FACTORY = 0x33128a8fC17869897dcE68Ed026d694621f6FDfD; // Base mainnet
+    address internal constant DEFAULT_V3_FACTORY = 0x33128a8fC17869897dcE68Ed026d694621f6FDfD; // Base mainnet
 
     // ─── Anvil test accounts ──────────────────────────────────────────────────
 
@@ -166,6 +166,7 @@ contract AttackRunner is Script {
 
     address internal swapRouter;
     address internal npmAddr;
+    address internal v3Factory;
     address internal advAddr;
     address internal recenterAddr;
     address internal lmAddr;
@@ -194,6 +195,7 @@ contract AttackRunner is Script {
         // Resolve periphery addresses from environment, falling back to mainnet defaults.
         swapRouter = vm.envOr("SWAP_ROUTER", DEFAULT_SWAP_ROUTER);
         npmAddr = vm.envOr("NPM_ADDR", DEFAULT_NPM_ADDR);
+        v3Factory = vm.envOr("V3_FACTORY", DEFAULT_V3_FACTORY);
 
         // Load deployment addresses before broadcast.
         string memory deploymentsPath = _deploymentsPath();
@@ -207,7 +209,7 @@ contract AttackRunner is Script {
         recenterAddr = vm.addr(RECENTER_PK);
 
         // Derive pool address from factory.
-        pool = IUniswapV3Pool(IUniswapV3Factory(V3_FACTORY).getPool(WETH, krkAddr, POOL_FEE));
+        pool = IUniswapV3Pool(IUniswapV3Factory(v3Factory).getPool(WETH, krkAddr, POOL_FEE));
         require(address(pool) != address(0), "AttackRunner: pool not found");
         token0isWeth = pool.token0() == WETH;